GHSA-mm7v-vpv8-xfc3 CVE-2019-15551 RUSTSEC-2019-0009
Double free in smallvec
- Severity
- 9.8 / 10
- Critical · CVSS 3.0
- Exploit chance (EPSS)
- 1.86%
- Chance of exploitation in the next 30 days. Higher than 79.25% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-415 Double Free
- Fix
0.6.10- Upgrade smallvec to this version or later
Description
Attempting to call grow on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents. An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| smallvec | >= 0.6.5, < 0.6.10 |
0.6.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
smallvec crates.io → 0.6.10
- cargo
cargo update -p smallvec --precise 0.6.10
Severity breakdown
CVSS 3.0 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Implementation: Use a static analysis tool to find double free instances.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-43w2-9j62-hq99 Buffer overflow in SmallVec::insert_many | Critical | Also affects smallvec |
| GHSA-69gw-hgj3-45m7 Memory corruption in smallvec | Critical | Also affects smallvec |
| GHSA-66p5-j55p-32r9 Use of Uninitialized Resource in smallvec | High | Also affects smallvec |
| GHSA-rxr4-x558-x7hw Double free in smallvec | Critical | Also affects smallvec |
| GO-2026-4981 Crash when handling long CNAME response in net | High | Same weakness, CWE-415 |
| GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution | Medium | Same weakness, CWE-415 |
| CVE-2026-33824 Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. | Critical Known exploited | Same weakness, CWE-415 |
| CVE-2025-62215 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate… | High Known exploited | Same weakness, CWE-415 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor