Every CVE Search/ Get API key

CVE-2021-45720

Use after free in lru crate

7.5 HighFix available

An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.22%Up 0.6 points since Dec 27, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.

Record
CVE-2021-45720
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.

Record
CVE-2021-45720
Updated
2026-11-02
EUVDEUVD-2022-0695 No score

An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.

Record
EUVD-2022-0695
Updated
2026-11-03
GitHub AdvisoriesGHSA-v362-2895-h9r2 7.5

Use After Free in lru

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.

Record
GHSA-v362-2895-h9r2
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
GitHub AdvisoriesGHSA-qqmc-hwqp-8g2w No score

Use after free in lru crate

Lru crate has use after free vulnerability.

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.

Record
GHSA-qqmc-hwqp-8g2w
Updated
2026-11-02
OSVGHSA-v362-2895-h9r2 7.5

Use After Free in lru

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.

Record
GHSA-v362-2895-h9r2
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVGHSA-qqmc-hwqp-8g2w No score

Use after free in lru crate

Lru crate has use after free vulnerability.

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.

Record
GHSA-qqmc-hwqp-8g2w
Updated
2026-11-02
OSVRUSTSEC-2021-0130 No score

Use after free in lru crate

Lru crate has use after free vulnerability.

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.

Record
RUSTSEC-2021-0130
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lru
crates.io
before 0.7.1
0.7.1
lru
crates.io
0.0.0-0 up to 0.7.1
0.7.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-45720 is a high vulnerability (CVSS 7.5) in Lru Project Lru, published December 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in lru 0.7.1.

References

MoveEnter Open