CVE-2019-16139

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-16148.8A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands wiCVE-2019-161409.8An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.CVE-2019-161417.5An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.CVE-2019-161429.8An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is inCVE-2019-161439.8An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrecCVE-2019-161447.5An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API caCVE-2019-161456.1The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.CVE-2019-161464.8Gophish through 0.8.0 allows XSS via a username.CVE-2019-161476.1Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.CVE-2019-161486.1Sakai through 12.6 allows XSS via a chat user name.CVE-2019-161496.1An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthCVE-2019-16156.7A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with admini
CVE-2019-16139: Critical severity, CVSS 9.8 | Vulnix