Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

thin-vec

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3crates.ioPublished

    thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

    CVE-2026-6654 · GHSA-xphw-cqx3-667j

    Affected
    • crates.io thin-vec < 0.2.16
    Fixed in
    0.2.16· Vendor fix available
    Issue
    A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thinvec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN). --- Details Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (setlen(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF). Vulnerability 1 — IntoIter::drop Location: thin-vec/src/lib.rs L.2308~2314 IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::dropinplace. If a panic occurs during element deallocation, setlennonsingleton(0) is never reached. During unwinding, vec is…

    Recommended action: Upgrade to 0.2.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →