CVE-2026-33184: Rust Unwrap Unchecked Subtraction

Subtracting directly from an unwrapped and/or cast value can cause an integer underflow if the value is zero. `Option` types typically validate presence, not numerical bounds. Use `.saturating_sub()`, `.checked_sub()`, or explicitly check that the value is strictly greater than the subtrahend.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Rust
greprules fetch cve-2026-33184-rust-unwrap-unchecked-subtraction --engine opengrep

Description

Subtracting directly from an unwrapped and/or cast value can cause an integer underflow if the value is zero. `Option` types typically validate presence, not numerical bounds. Use `.saturating_sub()`, `.checked_sub()`, or explicitly check that the value is strictly greater than the subtrahend.