CVE-2025-47737 is a low severity memory management flaw (CVSS 2.9) in the trailer crate for Rust, through version 0.1.2. The record says lib.rs mishandles allocating with a size of zero. No fixed version is confirmed, so check the project issue and your own use of the crate.
What's affected
The record says the trailer crate through 0.1.2 is affected, and that lib.rs mishandles allocation with a size of zero. The references are the crates.io page and a GitHub issue titled Unsound issue in Trailer.
The vector is local with high attack complexity, no privileges and no user interaction. Only availability is affected, and at a low level. That explains the 2.9 score.
The record does not list a patched release, and I could not confirm one.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find out whether the crate is anywhere in your dependency tree, including indirect use. In a Rust project, run:
cargo tree -i trailer
cargo audit
The first command shows which of your crates depend on trailer. The second checks your lockfile against the RustSec advisory database, which may or may not carry an entry for this CVE. If trailer appears at version 0.1.2 or lower, you are in the affected range.
Also search your own source for direct use. Unsafe code in a small crate only matters if your program calls the affected path.
What to do now
- Run cargo tree -i trailer in each Rust project to see whether the crate is used.
- Read the GitHub issue and the crates.io page for any newer release or advice from the maintainer.
- Update if a fixed release exists.
- If there is none, consider replacing the crate with an alternative that handles aligned or zero sized allocations safely, or wrapping the call so a size of zero is never passed.
- Check whether your code reaches the allocation function at all. If it does not, the practical risk is small.
- Note the decision in your dependency register.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record tags this as CWE-762, which belongs to the family of memory management weaknesses. Asking an allocator for zero bytes is an edge case that many allocation interfaces define loosely. If code assumes it works like any other size, the result can be undefined behavior.
The GitHub issue calls the problem unsound. That means a function that looks safe to call from safe Rust can still lead to undefined behavior. The score is low because exploitation needs local access and rare conditions. Even so, small crates are often pulled in deep in a dependency tree, so it is worth knowing where this one sits.
Quick check
Is trailer 0.1.2 the last affected version?
The record says the crate is affected through 0.1.2 and lists no fix. Check the crate page for newer releases.
Should I worry about a score of 2.9?
Treat it as low priority, but check whether your code reaches the affected function. Reachability tells you more than the score.
Sources
Last reviewed: 18 October 2026.
