RUSTSEC-2026-0274None▾ SunlitDouble free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
ReadChunk::commit and ReadChunk::commit_all drop the committed elements
before advancing the consumer head. If an element's Drop panics during the
drop loop, head is never advanced, so the ring buffer still treats those slots
as holding live elements. When the RingBuffer is later dropped (it walks
head..tail and drops each slot), or a subsequent read_chunk() / commit()
touches the same slots, the already-dropped elements are dropped a second time —
a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.
Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior
change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.
rtrb >= 0.4.0-0, < 0.4.0Upgrade to a patched release:
rtrb 0.4.0