RUSTSEC-2026-0131

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0131

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0131.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0131

Published

2026-05-02T12:00:00Z

Modified

2026-05-13T12:45:12Z

Summary

Double-free in `Chomp::inner()`

Details

Chomp::inner() uses std::ptr::read_unaligned to move out the value from a raw pointer. If the original value is an owned type (e.g. Box), calling inner() moves out the ownership, but the original variable will still be dropped at the end of its scope. This causes the same heap memory to be freed twice, resulting in a double-free and undefined behavior.

This can be triggered through safe public APIs — Chomp::new() and Chomp::inner() — with no unsafe required from the caller.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / bitchomp

Package

Name: bitchomp; View open source insights on deps.dev
Purl: pkg:cargo/bitchomp

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}