From b3022976dedbf0eb32a1faf33e2fe498e927bc95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexander=20Kj=C3=A4ll?= <alexander.kjall@gmail.com>
Date: Sat, 10 Jan 2026 18:47:06 +0100
Subject: [PATCH] trailer: add information about CVE-2025-47737

---
 crates/trailer/RUSTSEC-0000-0000.md | 52 +++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 crates/trailer/RUSTSEC-0000-0000.md

diff --git a/crates/trailer/RUSTSEC-0000-0000.md b/crates/trailer/RUSTSEC-0000-0000.md
new file mode 100644
index 000000000..45063b82c
--- /dev/null
+++ b/crates/trailer/RUSTSEC-0000-0000.md
@@ -0,0 +1,52 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "trailer"
+date = "2025-05-04"
+url = "https://github.com/Geal/trailer/issues/2"
+aliases = ["CVE-2025-47737"]
+cvss = "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
+
+[versions]
+patched = []
+unaffected = []
+
+[affected]
+```
+
+# Unsound issue in Trailer
+
+Our static analyzer find a potential unsound issue
+in the construction of Trailer, where it doesn't
+provide enough check to ensure the soundness.
+
+trailer/src/lib.rs, Lines 18 to 25 in d474984:
+```
+ pub fn new(capacity: usize) -> Trailer<T> { 
+     unsafe { 
+         let trailer = Trailer::allocate(capacity); 
+         let ptr = trailer.ptr as *mut T; 
+         ptr.write(T::default()); 
+         trailer 
+     } 
+ } 
+```
+
+The constructor does not check the T is not a ZST in
+rust, and allocating with size 0 is considered
+as undefined behaviors in Rust. A poc code like
+below can work:
+
+```
+use trailer::Trailer;
+#[derive(Default)]
+struct Zst;
+
+fn main() {
+    let mut a = Trailer::<Zst>::new(0);
+    drop(a);
+}
+```
+
+The trailer crate is unmaintained and this security issue
+will not be fixed.