GHSA-rxr4-x558-x7hw CVE-2018-20991 RUSTSEC-2018-0003
Double free in smallvec
- Severity
- 9.8 / 10
- Critical · CVSS 3.0
- Exploit chance (EPSS)
- 1.85%
- Chance of exploitation in the next 30 days. Higher than 79.09% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-415 Double Free
- Fix
0.6.3- Upgrade smallvec to this version or later
Description
If an iterator passed to SmallVec::insert_many panicked in Iterator::next, destructors were run during unwinding while the vector was in an inconsistent state, possibly causing a double free (a destructor running on two copies of the same value).
This is fixed in smallvec 0.6.3 by ensuring that the vector's length is not updated to include moved items until they have been removed from their original positions. Items may now be leaked if Iterator::next panics, but they will not be dropped more than once.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| smallvec | >= 0.3.2, < 0.6.3 |
0.6.3 |
| smallvec | >= 0.3.2, < 0.3.4>= 0.4.0-0, < 0.4.5>= 0.5.0-0, < 0.5.1>= 0.6.0-0, < 0.6.3 |
0.3.40.4.50.5.10.6.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
smallvec crates.io → 0.6.3
- cargo
cargo update -p smallvec --precise 0.6.3
Severity breakdown
CVSS 3.0 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Implementation: Use a static analysis tool to find double free instances.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-43w2-9j62-hq99 Buffer overflow in SmallVec::insert_many | Critical | Also affects smallvec |
| GHSA-69gw-hgj3-45m7 Memory corruption in smallvec | Critical | Also affects smallvec |
| GHSA-mm7v-vpv8-xfc3 Double free in smallvec | Critical | Also affects smallvec |
| GHSA-66p5-j55p-32r9 Use of Uninitialized Resource in smallvec | High | Also affects smallvec |
| GO-2026-4981 Crash when handling long CNAME response in net | High | Same weakness, CWE-415 |
| GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution | Medium | Same weakness, CWE-415 |
| CVE-2026-33824 Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. | Critical Known exploited | Same weakness, CWE-415 |
| CVE-2025-62215 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate… | High Known exploited | Same weakness, CWE-415 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor