---
id: RUSTSEC-2023-0126
title: Aliasing violation in `OrdSet` insertion
summary: Aliasing violation in `OrdSet` insertion
severity: none
vendor: im
product: im
ecosystem: rust
affected:
  - im >= 0.0.0-0
published: '2023-02-04'
updated: '2026-08-10'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2023-0126'
references:
  - url: 'https://crates.io/crates/im'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0126.html'
  - url: 'https://github.com/bodil/im-rs/issues/207'
tags:
  - osv
  - rust
ingestedAt: '2026-08-11T19:17:10.156Z'
---

## Overview

Inserting into an `im::OrdSet` (for example by collecting an iterator into one) can violate
Rust's aliasing rules: Miri reports a stacked borrows violation in
`sized_chunks::Chunk::force_copy()`, which is called during insertion, where a shared borrow
is invalidated by a unique borrow before the read through it completes.
This is undefined behavior, reachable from safe code.

No fixed version is available, as the crate is unmaintained; its GitHub
repository was archived by the owner on 2026-05-03.

## Affected packages

- `im >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.