CVE-2021-28876

In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

• CWE-755

• https://github.com/rust-lang/rust/issues/81740Exploit, Issue Tracking, Third Party Advisory
• https://github.com/rust-lang/rust/pull/81741Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/
• https://security.gentoo.org/glsa/202210-09Third Party Advisory
• https://github.com/rust-lang/rust/issues/81740Exploit, Issue Tracking, Third Party Advisory
• https://github.com/rust-lang/rust/pull/81741Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/
• https://security.gentoo.org/glsa/202210-09Third Party Advisory

Published

Apr 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28857TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username…7.5
• CVE-2021-28858TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not…5.5
• CVE-2021-28860In Node.js mixme, prior to v0.5.1, an attacker can add or al…9.1
• CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerabilit…7.4
• CVE-2021-28874SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f238668…7.8
• CVE-2021-28875In the standard library in Rust before 1.50.0, read_to_end()…7.5
• CVE-2021-28877In the standard library in Rust before 1.51.0, the Zip imple…7.5
• CVE-2021-28878In the standard library in Rust before 1.52.0, the Zip imple…7.5
• CVE-2021-28879In the standard library in Rust before 1.52.0, the Zip imple…9.8
• CVE-2021-28890J2eeFAST 2.2.1 allows remote attackers to perform SQL inject…9.8
• CVE-2021-28899Vulnerability in the AC3AudioFileServerMediaSubsession, ADTS…7.5
• CVE-2021-28901Multiple cross-site scripting (XSS) vulnerabilities exist in…5.4