RUSTSEC-2026-0007: Integer overflow in `BytesMut::reserve`

| Details | |
| --- | --- |
| Package | `bytes` |
| Version | `1.9.0` |
| URL | https://github.com/advisories/GHSA-434x-w66g-qw3r |
| Patched Versions | >=1.11.1 |
| Unaffected Versions | <1.2.1 |
| Aliases | [CVE-2026-25541](https://nvd.nist.gov/vuln/detail/CVE-2026-25541), [GHSA-434x-w66g-qw3r](https://github.com/advisories/GHSA-434x-w66g-qw3r) |

In the unique reclaim path of `BytesMut::reserve`, the condition
```rs
if v_capacity >= new_cap + offset
```
uses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

## PoC

```rs
use bytes::*;

fn main() {
let mut a = BytesMut::from(&b"hello world"[..]);
let mut b = a.split_off(5);

// Ensure b becomes the unique owner of the backing storage
drop(a);

// Trigger overflow in new_cap + offset inside reserve
b.reserve(usize::MAX - 6);

// This call relies on the corrupted cap and may cause UB & HBO
b.put_u8(b'h');
}
```

# Workarounds

Users of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.