{"history":[{"alert":0,"cve":"CVE-2020-36323","id":22063,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.02025, \"percentile\": 0.81281}"},{"alert":0,"cve":"CVE-2020-36323","id":21102,"kind":"epss","observed_at":1794392402,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.02025, \"percentile\": 0.81162}"},{"alert":1,"cve":"CVE-2020-36323","id":20985,"kind":"cna","observed_at":1794392402,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-04T17:23:10.528Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/rust-lang/rust/issues/80335\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/rust-lang/rust/pull/81728\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174\"}, {\"name\": \"FEDORA-2021-d0ba1901ca\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190\"}, {\"name\": \"FEDORA-2021-b1ba54add6\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/\"}, {\"name\": \"FEDORA-2021-d7f74f0250\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/\"}], \"title\": \"CVE Program Container\"}], \"cna\": {\"affected\": [{\"product\": \"n/a\", \"vendor\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"n/a\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-04-27T03:08:43.000Z\", \"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rust-lang/rust/issues/80335\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rust-lang/rust/pull/81728\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174\"}, {\"name\": \"FEDORA-2021-d0ba1901ca\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190\"}, {\"name\": \"FEDORA-2021-b1ba54add6\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/\"}, {\"name\": \"FEDORA-2021-d7f74f0250\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"cve@mitre.org\", \"ID\": \"CVE-2020-36323\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"n/a\", \"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}}]}, \"vendor_name\": \"n/a\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://github.com/rust-lang/rust/issues/80335\", \"refsource\": \"MISC\", \"url\": \"https://github.com/rust-lang/rust/issues/80335\"}, {\"name\": \"https://github.com/rust-lang/rust/pull/81728\", \"refsource\": \"MISC\", \"url\": \"https://github.com/rust-lang/rust/pull/81728\"}, {\"name\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174\", \"refsource\": \"MISC\", \"url\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174\"}, {\"name\": \"FEDORA-2021-d0ba1901ca\", \"refsource\": \"FEDORA\", \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/\"}, {\"name\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190\", \"refsource\": \"MISC\", \"url\": \"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190\"}, {\"name\": \"FEDORA-2021-b1ba54add6\", \"refsource\": \"FEDORA\", \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/\"}, {\"name\": \"FEDORA-2021-d7f74f0250\", \"refsource\": \"FEDORA\", \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"assignerShortName\": \"mitre\", \"cveId\": \"CVE-2020-36323\", \"datePublished\": \"2021-04-14T06:10:09.000Z\", \"dateReserved\": \"2021-04-14T00:00:00.000Z\", \"dateUpdated\": \"2024-08-04T17:23:10.528Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"}],"record":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-04T17:23:10.528Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rust-lang/rust/issues/80335"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rust-lang/rust/pull/81728"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174"},{"name":"FEDORA-2021-d0ba1901ca","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190"},{"name":"FEDORA-2021-b1ba54add6","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/"},{"name":"FEDORA-2021-d7f74f0250","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-04-27T03:08:43.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"https://github.com/rust-lang/rust/issues/80335"},{"tags":["x_refsource_MISC"],"url":"https://github.com/rust-lang/rust/pull/81728"},{"tags":["x_refsource_MISC"],"url":"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174"},{"name":"FEDORA-2021-d0ba1901ca","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/"},{"tags":["x_refsource_MISC"],"url":"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190"},{"name":"FEDORA-2021-b1ba54add6","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/"},{"name":"FEDORA-2021-d7f74f0250","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-36323","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/rust-lang/rust/issues/80335","refsource":"MISC","url":"https://github.com/rust-lang/rust/issues/80335"},{"name":"https://github.com/rust-lang/rust/pull/81728","refsource":"MISC","url":"https://github.com/rust-lang/rust/pull/81728"},{"name":"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174","refsource":"MISC","url":"https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174"},{"name":"FEDORA-2021-d0ba1901ca","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/"},{"name":"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190","refsource":"MISC","url":"https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190"},{"name":"FEDORA-2021-b1ba54add6","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/"},{"name":"FEDORA-2021-d7f74f0250","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2020-36323","datePublished":"2021-04-14T06:10:09.000Z","dateReserved":"2021-04-14T00:00:00.000Z","dateUpdated":"2024-08-04T17:23:10.528Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794500401,"cve":"CVE-2020-36323","description":"In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.","epss":{"date":"2026-11-12","epss":0.02025,"percentile":0.81281},"epss_checked":1794522003,"first_seen":1794378633,"kev":null,"kev_checked":1794522003,"products":"n/a n/a","references":["https://github.com/rust-lang/rust/issues/80335","https://github.com/rust-lang/rust/pull/81728","https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/","https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/"],"score":null,"solutions":"","state":"PUBLISHED","title":"CVE-2020-36323","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.microsoft.com/en-us/security/blog/2026/11/09/forge-lab-uses-agentic-tools-to-identify-memory-safety-issues-in-rust/","id":380,"publisher":"Microsoft","title":"FORGE Lab uses agentic tools to identify memory safety issues in Rust | Microsoft Security Blog"}]}