RUSTSEC-2023-0126None▾ SunlitAliasing violation in `OrdSet` insertion
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Inserting into an im::OrdSet (for example by collecting an iterator into one) can violate
Rust's aliasing rules: Miri reports a stacked borrows violation in
sized_chunks::Chunk::force_copy(), which is called during insertion, where a shared borrow
is invalidated by a unique borrow before the read through it completes.
This is undefined behavior, reachable from safe code.
No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.
im >= 0.0.0-0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.