---
id: RUSTSEC-2026-0242
aliases:
  - GHSA-7hc7-h3f2-r4j6
title: Safe ErrorRegistry APIs can cause undefined behavior
summary: Safe ErrorRegistry APIs can cause undefined behavior
severity: none
vendor: dcrypt-api
product: dcrypt-api
ecosystem: rust
affected:
  - 'dcrypt-api >= 0.0.0-0, < 2.0.0'
patched:
  - dcrypt-api 2.0.0
published: '2026-08-09'
updated: '2026-08-09'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0242'
references:
  - url: 'https://crates.io/crates/dcrypt-api'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0242.html'
  - url: >-
      https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-7hc7-h3f2-r4j6
  - url: >-
      https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8
  - url: 'https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0'
tags:
  - osv
  - rust
ingestedAt: '2026-08-09T19:16:06.219Z'
---

## Overview

All published versions of `dcrypt-api` before 2.0.0 exposed safe
`ErrorRegistry` operations that could trigger undefined behavior when the
default `std` feature was enabled.

Stored `Box<E>` values were erased to raw pointers and later deallocated as
`Box<()>`. The `get_error<E>` operation also performed an unchecked cast to a
caller-selected type. Finally, concurrent replacement or clearing could free a
value while another thread cloned it. Ordinary safe Rust could therefore cause
mismatched deallocation, type confusion, and use-after-free. Crates that
re-exported this API are affected transitively.

Version 2.0.0 replaces the raw pointers with owned `Box<dyn Any + Send>` values
behind a mutex, performs checked downcasts, and uses a mutation generation so
concurrent stores and clears win safely. There is no reliable workaround while
calling the affected registry API. Upgrade to 2.0.0 or later and avoid
process-global error state where possible.

## Affected packages

- `dcrypt-api >= 0.0.0-0, < 2.0.0`

## Remediation

Upgrade to a patched release:

- `dcrypt-api 2.0.0`