{
 "item_id": "ker-bytes_reserve",
 "kernel": "bytes_reserve",
 "advisory": "RUSTSEC-2026-0007",
 "crate": "bytes",
 "pre_version": "1.11.0",
 "post_version": "1.11.1",
 "advisory_url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f",
 "title": "Integer overflow in `BytesMut::reserve`",
 "source_file": "src/bytes_mut.rs",
 "function": "reserve_fits",
 "signature": "pub fn reserve_fits(v_capacity: usize, new_cap: usize, offset: usize) -> bool",
 "spec_doc": "Decides whether a Vec-backed buffer with capacity v_capacity can serve a reserve request of new_cap bytes when the live window starts at offset; must be true iff v_capacity >= new_cap + offset in exact arithmetic.",
 "bug_class": "overflow",
 "fidelity": "verbatim_logic",
 "extraction_note": "src/bytes_mut.rs reserve_inner: new_cap + offset overflow",
 "witness_args": "10usize, usize::MAX, 1usize",
 "labels": {
  "buggy": "bytes@1.11.0",
  "reference": "bytes@1.11.1"
 }
}