RUSTSEC-2026-0528

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0528

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0528.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0528

Published

2026-11-12T12:00:00Z

Modified

2026-11-13T12:45:06Z

Summary

UB can be reached from safe code

Details

The variance of RefSwap and OptionRefSwap were incorrect, possibly allowing use-after-free.

OptionRefSwap::into_inner did not check for null.

The fix is to make RefSwap and OptionRefSwap invariant, and to change OptionRefSwap::into_inner to return an option. It is available in version 0.1.3. If your project still compiles with 0.1.3 then it is not affected by the unsoundness on version 0.1.2

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / ref-swap

Package

Name: ref-swap; View open source insights on deps.dev
Purl: pkg:cargo/ref-swap

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.1.3

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}