Critical severity9.8NVD Advisory· Published Dec 27, 2021· Updated Jun 17, 2026
CVE-2021-45707
CVE-2021-45707
Description
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nixcrates.io | >= 0.16.0, < 0.20.2 | 0.20.2 |
nixcrates.io | >= 0.21.0, < 0.21.2 | 0.21.2 |
nixcrates.io | >= 0.22.0, < 0.22.2 | 0.22.2 |
Affected products
4- rust/nixdescription
- ghsa-coords2 versions
>= 0.16.0, < 0.20.2+ 1 more
- (no CPE)range: >= 0.16.0, < 0.20.2
- (no CPE)range: < 0.1.7-r2
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-76w9-p8mg-j927ghsaADVISORY
- github.com/advisories/GHSA-wgrg-5h56-jg27nvdThird Party AdvisoryADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-45707ghsaADVISORY
- raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.mdnvdThird Party AdvisoryWEB
- rustsec.org/advisories/RUSTSEC-2021-0119.htmlnvdIssue TrackingThird Party AdvisoryWEB
- github.com/nix-rust/nix/issues/1541ghsaWEB
News mentions
0No linked articles in our index yet.