rustsec-2026-0274
Vulnerability from osv_rustsec
ReadChunk::commit and ReadChunk::commit_all drop the committed elements
before advancing the consumer head. If an element's Drop panics during the
drop loop, head is never advanced, so the ring buffer still treats those slots
as holding live elements. When the RingBuffer is later dropped (it walks
head..tail and drops each slot), or a subsequent read_chunk() / commit()
touches the same slots, the already-dropped elements are dropped a second time —
a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.
Mitigation
Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior
change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"categories": [
"memory-corruption"
],
"cvss": null,
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"rtrb::chunks::ReadChunk::commit",
"rtrb::chunks::ReadChunk::commit_all"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "rtrb",
"purl": "pkg:cargo/rtrb"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.3.5"
},
{
"introduced": "0.4.0-0"
},
{
"fixed": "0.4.0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "`ReadChunk::commit` and `ReadChunk::commit_all` drop the committed elements\nbefore advancing the consumer head. If an element\u0027s `Drop` panics during the\ndrop loop, `head` is never advanced, so the ring buffer still treats those slots\nas holding live elements. When the `RingBuffer` is later dropped (it walks\n`head..tail` and drops each slot), or a subsequent `read_chunk()` / `commit()`\ntouches the same slots, the already-dropped elements are dropped a second time \u2014\na double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.\n\n## Mitigation\n\nUpdate to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior\nchange in `is_abandoned()`, so users on 0.3.x should prefer 0.3.5.",
"id": "RUSTSEC-2026-0274",
"modified": "2026-09-01T07:55:13Z",
"published": "2026-08-04T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/rtrb"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0274.html"
},
{
"type": "REPORT",
"url": "https://github.com/mgeier/rtrb/issues/185"
}
],
"related": [],
"severity": [],
"summary": "Double free / use-after-free in `ReadChunk::commit` when an element\u0027s `Drop` panics"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.