RUSTSEC-2026-0292

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0292

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0292.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0292

Published

2026-09-04T12:00:00Z

Modified

2026-09-21T09:15:02Z

Summary

Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics

Details

Chunk::{clear, drop_left, drop_right} and InlineArray::{clear, truncate} drop the removed elements before updating the metadata that records which slots hold live values — the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update is never reached, so the collection still treats the already-dropped elements as live. When the collection is later dropped (its destructor walks the range described by the stale metadata), or a subsequent operation touches the same slots, those elements are dropped a second time — a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

The stale field is left and right for Chunk::clear, left for drop_left, right for drop_right, and the length field for both InlineArray methods.

Mitigation

Upgrade to imbl-sized-chunks 0.2.0 or later, which commits the metadata before dropping any element (fixed in jneem/imbl-sized-chunks#14, released in 0.2.0).

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / imbl-sized-chunks

Package

Name: imbl-sized-chunks; View open source insights on deps.dev
Purl: pkg:cargo/imbl-sized-chunks

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "imbl_sized_chunks::inline_array::InlineArray::clear",
            "imbl_sized_chunks::inline_array::InlineArray::truncate",
            "imbl_sized_chunks::sized_chunk::Chunk::clear",
            "imbl_sized_chunks::sized_chunk::Chunk::drop_left",
            "imbl_sized_chunks::sized_chunk::Chunk::drop_right"
        ],
        "os":  []
    }
}