RUSTSEC-2023-0126

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2023-0126

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0126.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2023-0126

Published

2023-02-04T12:00:00Z

Modified

2026-08-10T19:45:04.530371817Z

Summary

Aliasing violation in `OrdSet` insertion

Details

Inserting into an im::OrdSet (for example by collecting an iterator into one) can violate Rust's aliasing rules: Miri reports a stacked borrows violation in sized_chunks::Chunk::force_copy(), which is called during insertion, where a shared borrow is invalidated by a unique borrow before the read through it completes. This is undefined behavior, reachable from safe code.

No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / im

Package

Name: im; View open source insights on deps.dev
Purl: pkg:cargo/im

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

cvss

null

source

"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0126.json"