{"affected":[{"product":"bit-vec","source":"CNA: GitHub_M","vendor":"contain-rs","versions":[{"status":"affected","version":"< 0.10.0"}]}],"cveId":"CVE-2026-68510","cwes":["CWE-20"],"description":"bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794596239508,"publishedAt":1794596239508,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/contain-rs/bit-vec/security/advisories/GHSA-h4f4-f333-vh4h"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/contain-rs/bit-vec/pull/149"}],"remediation":[],"revision":"4fa61de02eacf100121e90eea0c2b22bb3278d1cdeff8946d22f1c6011dd58e6","sources":[{"modifiedAt":1794596239508,"name":"CNA: GitHub_M","retrievedAt":1794597957997,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68510"}],"ssvc":null,"status":"published","title":"bit-vec: unsoundness arising with `deserialize` then `get_unchecked`","updatedAt":1794597957997}