{"id":"RUSTSEC-2026-0242","aliases":["GHSA-7hc7-h3f2-r4j6"],"title":"Safe ErrorRegistry APIs can cause undefined behavior","summary":"Safe ErrorRegistry APIs can cause undefined behavior","severity":"none","vendor":"dcrypt-api","product":"dcrypt-api","ecosystem":"rust","affected":["dcrypt-api >= 0.0.0-0, < 2.0.0"],"patched":["dcrypt-api 2.0.0"],"published":"2026-08-09","updated":"2026-08-09","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0242","references":[{"url":"https://crates.io/crates/dcrypt-api"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0242.html"},{"url":"https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-7hc7-h3f2-r4j6"},{"url":"https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8"},{"url":"https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0"}],"tags":["osv","rust"],"ingestedAt":"2026-08-09T19:16:06.219Z","slug":"RUSTSEC-2026-0242","body":"## Overview\n\nAll published versions of `dcrypt-api` before 2.0.0 exposed safe\n`ErrorRegistry` operations that could trigger undefined behavior when the\ndefault `std` feature was enabled.\n\nStored `Box<E>` values were erased to raw pointers and later deallocated as\n`Box<()>`. The `get_error<E>` operation also performed an unchecked cast to a\ncaller-selected type. Finally, concurrent replacement or clearing could free a\nvalue while another thread cloned it. Ordinary safe Rust could therefore cause\nmismatched deallocation, type confusion, and use-after-free. Crates that\nre-exported this API are affected transitively.\n\nVersion 2.0.0 replaces the raw pointers with owned `Box<dyn Any + Send>` values\nbehind a mutex, performs checked downcasts, and uses a mutation generation so\nconcurrent stores and clears win safely. There is no reliable workaround while\ncalling the affected registry API. Upgrade to 2.0.0 or later and avoid\nprocess-global error state where possible.\n\n## Affected packages\n\n- `dcrypt-api >= 0.0.0-0, < 2.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dcrypt-api 2.0.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}