---
id: RUSTSEC-2026-0274
title: >-
  Double free / use-after-free in `ReadChunk::commit` when an element's `Drop`
  panics
summary: >-
  Double free / use-after-free in `ReadChunk::commit` when an element's `Drop`
  panics
severity: none
vendor: rtrb
product: rtrb
ecosystem: rust
affected:
  - 'rtrb >= 0.4.0-0, < 0.4.0'
patched:
  - rtrb 0.4.0
published: '2026-08-04'
updated: '2026-09-01'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0274'
references:
  - url: 'https://crates.io/crates/rtrb'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0274.html'
  - url: 'https://github.com/mgeier/rtrb/issues/185'
tags:
  - osv
  - rust
ingestedAt: '2026-09-02T19:31:28.062Z'
---

## Overview

`ReadChunk::commit` and `ReadChunk::commit_all` drop the committed elements
before advancing the consumer head. If an element's `Drop` panics during the
drop loop, `head` is never advanced, so the ring buffer still treats those slots
as holding live elements. When the `RingBuffer` is later dropped (it walks
`head..tail` and drops each slot), or a subsequent `read_chunk()` / `commit()`
touches the same slots, the already-dropped elements are dropped a second time —
a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

## Mitigation

Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior
change in `is_abandoned()`, so users on 0.3.x should prefer 0.3.5.

## Affected packages

- `rtrb >= 0.4.0-0, < 0.4.0`

## Remediation

Upgrade to a patched release:

- `rtrb 0.4.0`