CVE-2021-45720
Use after free in lru crate
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.5
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
- Record
CVE-2021-45720- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
- Record
CVE-2021-45720- Updated
- 2026-11-02
EUVDEUVD-2022-0695 No score
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
- Record
EUVD-2022-0695- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v362-2895-h9r2
7.5
Use After Free in lru
Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.
- Record
GHSA-v362-2895-h9r2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qqmc-hwqp-8g2w No score
Use after free in lru crate
Lru crate has use after free vulnerability.
Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.
- Record
GHSA-qqmc-hwqp-8g2w- Updated
- 2026-11-02
OSVGHSA-v362-2895-h9r2
7.5
Use After Free in lru
Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.
- Record
GHSA-v362-2895-h9r2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVGHSA-qqmc-hwqp-8g2w No score
Use after free in lru crate
Lru crate has use after free vulnerability.
Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.
- Record
GHSA-qqmc-hwqp-8g2w- Updated
- 2026-11-02
OSVRUSTSEC-2021-0130 No score
Use after free in lru crate
Lru crate has use after free vulnerability.
Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.
- Record
RUSTSEC-2021-0130- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45720 is a high vulnerability (CVSS 7.5) in Lru Project Lru, published December 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in lru 0.7.1.
References
rustsec.org/advisories/RUSTSEC-2021-0130.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/lru/RUSTSEC-2021-0130.md
github.com/jeromefroe/lru-rs/issues/120
github.com/advisories/GHSA-qqmc-hwqp-8g2w
nvd.nist.gov/vuln/detail/CVE-2021-45720
github.com/advisories/GHSA-v362-2895-h9r2
github.com/jeromefroe/lru-rs
github.com/jeromefroe/lru-rs.git
crates.io/crates/lru