Rust advisories / trailer
Vulnerability LowRUSTSEC-2025-0163 · trailer
RUSTSEC-2025-0163: Unsound issue in Trailer
Short answerA security vulnerability in the trailer crate: Unsound issue in Trailer. Low severity (CVSS 2.9). No fixed version: replace the crate or remove the affected code path.
| Crate | trailer |
|---|---|
| Type | Vulnerability |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Low, CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| Published | 2025-05-04 |
| Last changed | 2026-06-10 |
| Also known as | CVE-2025-47737, GHSA-6x45-r4pr-5362 |
What to do
- Find who pulls it in:
cargo tree -i trailer. - Avoid the affected API, or replace the crate.
Details from the advisory
Our static analyzer find a potential unsound issue in the construction of Trailer, where it doesn't provide enough check to ensure the soundness.
trailer/src/lib.rs, Lines 18 to 25 in d474984:
pub fn new(capacity: usize) -> Trailer<T> {
unsafe {
let trailer = Trailer::allocate(capacity);
let ptr = trailer.ptr as *mut T;
ptr.write(T::default());
trailer
}
} The constructor does not check the T is not a ZST in rust, and allocating with size 0 is considered as undefined behaviors in Rust. A poc code like below can work:
use trailer::Trailer;
#[derive(Default)]
struct Zst;
fn main() {
let mut a = Trailer::<Zst>::new(0);
drop(a);
}The trailer crate is unmaintained and this security issue will not be fixed.
References
- Package: crates.io/crates/trailer
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0163.html
- Report: github.com/Geal/trailer/issues/2
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?