🛡️ RUSTSEC-2025-0165 — i-tree

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

i_tree allowed out-of-bounds access through safe public node accessors

Affected versions of i_tree exposed safe public Tree::node and Tree::mut_node methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::get_unchecked / get_unchecked_mut on the internal node buffer, without validating that the index was in bounds.

Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any unsafe code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.

Starting with 0.10.0 the crate was restructured and these accessors are no longer reachable from outside the crate.

Affected software

RUSTSEC-2025-0165 is recorded against 1 package.

  • i-tree

Timeline and source

Published on 4 July 2025 and last revised on 29 June 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

crates.io (Package)
rustsec.org (Advisory)
github.com (Report)
github.com (Web)
github.com (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2025-07-04
Updated 2026-08-12
Modified 2026-06-29
Fix URL N/A

Affected Packages

Software From version Fixed in
i-tree — —

Free Vulnerability Check

Is your site affected by RUSTSEC-2025-0165?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against RUSTSEC-2025-0165 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.