Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
`OrderedSkipList`, `SkipSet` and `SkipMap` can free a node that is still linked when a `Comparator` or `Ord` implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe `impl Ord` with the default comparator is enough to reach it. The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-`Less` than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as `Less`, the walk steps past it and the assumption breaks. Removals such as `take_first`, `take` and `remove` then rewire the wrong link and free the target while its real predecessor still points at it. `insert` builds crossed links and wrong skip distances from the same precursors. A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The…
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard `Ord` types. 1. Splice back-pointer. `split_off`, `split_off_index` and `append` stored the first spliced node's `prev` pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later `pop_first` or `pop_front` writes through it. This affects all four collections. 2. `SkipMap::range_mut` back pointer. With an `Included` or `Excluded` upper bound, the back pointer came from a shared reference. `next_back` hands out `&mut V` through it, and writing to that value is undefined behaviour. 3. `IterMut::next_back` reads a yielded node. In `SkipList` and `SkipMap`, `next_back` read the predecessor node even after the front end had yielded it as `&mut`. The read freezes…
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
`SkipList::clear` drops the node chain and only then resets `tail` and `len`. The drop runs each element's `Drop`, and `T` carries no bounds excluding a panicking one. If it unwinds, `tail` still points at the freed node while `len` stays non-zero. `back()`, `back_mut()`, `last_key_value()` and `last()` dereference `tail` through `unsafe`, so reading the container after the unwind is a use-after-free (CWE-416). `Drop for SkipList` calls `Box::from_raw` on `self.head`, which `clear` already destroyed, so dropping the container is a double free (CWE-415). `retain`, `retain_mut` and `dedup_by` reach the same state through `Node::filter_rebuild`, which frees nodes and runs a user predicate before the caller commits `tail` and `len`. There the head links are left partially rewired, so traversal can also reach freed nodes. Mitigation Update to 1.1.1.
Recommended action: Upgrade to 1.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.