CVE-2018-25024

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.mdThird Party Advisory
https://rustsec.org/advisories/RUSTSEC-2018-0019.htmlIssue Tracking, Third Party Advisory
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.mdThird Party Advisory
https://rustsec.org/advisories/RUSTSEC-2018-0019.htmlIssue Tracking, Third Party Advisory

Timeline

Published: Dec 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-250259.8An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory c CVE-2018-250269.8An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent bet CVE-2018-250277.5An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.CVE-2018-250287.5An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.CVE-2018-250298.1The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio CVE-2018-25037.4By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This CVE-2018-250302.5A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto L CVE-2018-250314.3Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an att CVE-2018-250327.5zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.CVE-2018-250338.1ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in CVE-2018-250345.4A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processin CVE-2018-250355.4A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /g