CVE-2021-29940
Double free in through
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
- Record
CVE-2021-29940- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
- Record
CVE-2021-29940- Updated
- 2026-11-02
EUVDEUVD-2021-1576No score
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
- Record
EUVD-2021-1576- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5hpj-m323-cphm
Double free in through
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
- Record
GHSA-5hpj-m323-cphm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVGHSA-5hpj-m323-cphm
Double free in through
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
- Record
GHSA-5hpj-m323-cphm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0049
`through` and `through_and` causes a double free if the map function panics
through and through_and take a mutable reference as well as a mapping
function to change the provided reference. They do this by calling ptr::read
on the reference which duplicates ownership and then calling the mapping
function.
If the mapping function panics, both the original object and the one
duplicated by ptr::read get dropped, causing a double free.
- Record
RUSTSEC-2021-0049- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29940 is a critical vulnerability (CVSS 9.8) in Through Project Through, published February 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. No source names a fixed version.