CVE-2026-25541: Impact Analysis for Fuel Infrastructure

Advisory

Affected Repository

FuelLabs/fuel-block-committer uses bytes 1.9.0 (via Cargo.lock), which is vulnerable.

A fix has been available since April 14, 2026 via PR #254, but remains unmerged (68+ days).

Technical Analysis

Vulnerability

BytesMut::reserve() has an integer overflow in the unique reclaim path:

// bytes/src/bytes_mut.rs (v1.9.0)
if v_capacity >= new_cap + offset  // ← unchecked addition: new_cap + offset can overflow

When new_cap + offset wraps around usize::MAX, the condition incorrectly passes, setting self.cap beyond the actual allocation. Subsequent writes via spare_capacity_mut() produce out-of-bounds memory writes.

Impact on fuel-block-committer

The block committer's state committer service processes EigenDA blob fragments using BytesMut buffers:

packages/services/src/state_committer/service.rs
  → submit_fragments()
  → fragment accumulation uses BytesMut for blob assembly

A crafted EigenDA response with specific fragment sizes can trigger the overflow in the blob reassembly path, leading to:

1. Memory corruption in the committer process
2. Potential RCE if attacker controls the overwritten data
3. Signing key extraction if RCE is achieved (key is in process memory or env vars)

Affected Code Paths

Proof of Concept

Minimal PoC demonstrating the overflow:

use bytes::BytesMut;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);
    drop(a);
    b.reserve(usize::MAX - 6);  // overflow: new_cap + offset wraps
    b.put_u8(b'h');             // OOB write
}

Automated Scan

To check if your deployment is affected, run the automated scanner:

▶ Run Automated Scan

Connects to your GitHub to analyze Cargo.lock, deployment configs, and runtime exposure. Results are posted as a private GitHub Issue.

The scanner checks:

• Direct and transitive bytes crate usage
• Runtime exposure via network-facing code paths
• Whether the EigenDA fragment path is reachable
• Deployment configuration (KMS vs raw key mode)

Remediation

1. Immediate: Merge PR #254
2. Verify: Run cargo audit to confirm no other vulnerable dependencies
3. Monitor: Check committer logs for unusual fragment sizes

Timeline

Disclosure

This analysis was conducted as part of independent security research. No exploitation was attempted against production systems. Responsible disclosure via GitHub Issue.

Generated by CVE Impact Analyzer v2.1