RUSTSEC-2026-0255
Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visited again — a use-after-free / double-free reachable from safe Rust.
The RingBuffer methods require the ringbuffer feature. This is distinct from RUSTSEC-2020-0041 (Chunk::clone / insert_from, fixed in 0.6.3); the methods here are still affected in 0.7.0. The repository is archived with issues/PRs disabled and no fix available.
Impact
- CWE-415 (Double Free): the same allocation is freed twice.
- CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated
Drop.
Reachable entirely from safe Rust via catch_unwind with element types whose Drop can panic.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| sized-chunks | >= 0.0.0-0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0251 sized-chunks is unmaintained | Not rated yet | Also affects sized-chunks |
| GHSA-fqpx-cq8x-9wp4 Array size is not checked in sized-chunks | High | Also affects sized-chunks |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor