{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "pared"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-24T16:06:28Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Affected versions of this crate didn\u0027t provide sufficient lifetime constraints to conversion functions from `alloc::sync::Arc` and `alloc::rc::Rc`, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data\u0027s lifetimes.\n\nThis projected pointer could cause the original `Arc`\u0027s or `Rc`\u0027s `Drop::drop` to get called at a point where the original data was no longer valid, leading to a potential use after free.\n\nThe affected functions were\n- `pared::prc::Prc::from_rc`\n- `pared::prc::Prc::project`\n- `pared::prc::Prc::try_from_rc`\n- `pared::sync::Parc::from_arc`\n- `pared::sync::Parc::project`\n- `pared::sync::Parc::try_from_arc`\n\nThis flaw was fixed in [108f540ea8acb6073751a1aa386085c1cdc4fd1e](https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e) by requiring that the type stored in the `Arc`s and `Rc`s passed to these functions contain `T: \u0027static`.",
  "id": "GHSA-vgmh-mqm4-8j88",
  "modified": "2025-03-24T16:06:28Z",
  "published": "2025-03-24T16:06:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/radekvit/pared/issues/2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/radekvit/pared"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0016.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints"
}