GHSA-rhfx-m35p-ff5j
`IterMut` violates Stacked Borrows by invalidating internal pointer
Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
`IterMut` violates Stacked Borrows by invalidating internal pointer
Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.
- Record
GHSA-rhfx-m35p-ff5j- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
`IterMut` violates Stacked Borrows by invalidating internal pointer
Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.
- Record
GHSA-rhfx-m35p-ff5j- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0002No score
`IterMut` violates Stacked Borrows by invalidating internal pointer
Affected versions of this crate contain a soundness issue in the IterMut
iterator implementation. The IterMut::next and IterMut::next_back
methods temporarily create an exclusive reference to the key when
dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal HashMap,
violating Stacked Borrows rules.
- Record
RUSTSEC-2026-0002- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lrucrates.io | 0.9.0 up to 0.16.3 | 0.16.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-rhfx-m35p-ff5j is a low vulnerability (CVSS 2.7) in lru, published January 7, 2026. No source lists public exploit code. Fixed in lru 0.16.3.