RUSTSEC-2026-0274

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0274

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0274.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0274

Published

2026-08-04T12:00:00Z

Modified

2026-09-01T08:00:25.184913524Z

Summary

Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics

Details

ReadChunk::commit and ReadChunk::commit_all drop the committed elements before advancing the consumer head. If an element's Drop panics during the drop loop, head is never advanced, so the ring buffer still treats those slots as holding live elements. When the RingBuffer is later dropped (it walks head..tail and drops each slot), or a subsequent read_chunk() / commit() touches the same slots, the already-dropped elements are dropped a second time — a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

Mitigation

Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / rtrb

Package

Name: rtrb; View open source insights on deps.dev
Purl: pkg:cargo/rtrb

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.5

Introduced

0.4.0-0

Fixed

0.4.0

Ecosystem specific

{
    "affects": {
        "os": [],
        "functions": [
            "rtrb::chunks::ReadChunk::commit",
            "rtrb::chunks::ReadChunk::commit_all"
        ],
        "arch": []
    },
    "affected_functions": null
}

Database specific

cvss

null