RUSTSEC-2019-0010: MultiDecoder::read() drops uninitialized memory of arbitrary type on panic in client code

What to do

1. See which version you have: cargo tree -i libflate (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p libflate. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example libflate = "0.1.25") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of libflate have set a field of an internal structure with a generic type to an uninitialized value in MultiDecoder::read() and reverted it to the original value after the function completed. However, execution of MultiDecoder::read() could be interrupted by a panic in caller-supplied Read implementation. This would cause drop() to be called on uninitialized memory of a generic type implementing Read.

This is equivalent to a use-after-free vulnerability and could allow an attacker to gain arbitrary code execution.

The flaw was corrected by aborting immediately instead of unwinding the stack in case of panic within MultiDecoder::read(). The issue was discovered and fixed by Shnatsel.

References

• Package: crates.io/crates/libflate
• Advisory: rustsec.org/advisories/RUSTSEC-2019-0010.html
• Report: github.com/sile/libflate/issues/35

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.