CVE-2026-68510

CVSS 6.9 (medium) · published 2026-11-13

bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0.

Weakness: CWE-20

Source: NVD CVE-2026-68510

References

• https://github.com/contain-rs/bit-vec/pull/149
• https://github.com/contain-rs/bit-vec/security/advisories/GHSA-h4f4-f333-vh4h

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.