AIKIDO-2025-10580

TL;DR

Affected versions of this package are vulnerable to Out-of-bounds Access due to improper bounds checking when handling partial writes in vectored I/O. The vulnerability occurs when processing the first frame in the queue: if bytes_written exceeds the header length but is larger than the payload length, the unsafe get_unchecked call attempts to create a slice starting beyond the payload buffer boundaries. An attacker could exploit this by sending a large number of messages rapidly, triggering partial writes and causing the bytes_written value to corrupt memory or read out-of-bounds data, potentially leading to a denial of service or information disclosure.