GHSA-9qxh-258v-666c
owning_ref vulnerable to multiple soundness issues
OwningRef::map_with_owneris unsound and may result in a use-after-free.OwningRef::mapis unsound and may result in a use-after-free.OwningRefMut::as_ownerandOwningRefMut::as_owner_mutare unsound and may result in a use-after-free.- The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM
noaliasattribute.
No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.
What each source reports
GitHub AdvisoriesNo score
owning_ref vulnerable to multiple soundness issues
OwningRef::map_with_owneris unsound and may result in a use-after-free.OwningRef::mapis unsound and may result in a use-after-free.OwningRefMut::as_ownerandOwningRefMut::as_owner_mutare unsound and may result in a use-after-free.- The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM
noaliasattribute.
No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.
- Record
GHSA-9qxh-258v-666c- Updated
- 2026-11-02
OSVNo score
owning_ref vulnerable to multiple soundness issues
OwningRef::map_with_owneris unsound and may result in a use-after-free.OwningRef::mapis unsound and may result in a use-after-free.OwningRefMut::as_ownerandOwningRefMut::as_owner_mutare unsound and may result in a use-after-free.- The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM
noaliasattribute.
No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.
- Record
GHSA-9qxh-258v-666c- Updated
- 2026-11-02
OSVRUSTSEC-2022-0040No score
Multiple soundness issues in `owning_ref`
OwningRef::map_with_owneris unsound and may result in a use-after-free.OwningRef::mapis unsound and may result in a use-after-free.OwningRefMut::as_ownerandOwningRefMut::as_owner_mutare unsound and may result in a use-after-free.- The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM
noaliasattribute.
safer_owning_ref is a replacement crate which fixes these issues.
No patched versions of the original crate are available, and the maintainer is unresponsive.
- Record
RUSTSEC-2022-0040- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
owning_refcrates.io | through 0.4.1 | None known |
owning_refcrates.io | 0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9qxh-258v-666c is a vulnerability with no CVSS score yet in owning_ref, published January 26, 2022. No source lists public exploit code. No source names a fixed version.
References
github.com/noamtashma/owning-ref-unsoundness
rustsec.org/advisories/RUSTSEC-2022-0040.html
github.com/advisories/GHSA-9qxh-258v-666c
github.com/Kimundi/owning-ref-rs
crates.io/crates/owning_ref
github.com/Kimundi/owning-ref-rs/issues/49
github.com/Kimundi/owning-ref-rs/issues/61
github.com/Kimundi/owning-ref-rs/issues/71
github.com/Kimundi/owning-ref-rs/issues/77