Every CVESearch/Get API key

GHSA-vgmh-mqm4-8j88

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

6.8 MediumFix available

GHSA-vgmh-mqm4-8j88 is a medium vulnerability (CVSS 6.8) in pared, published March 13, 2025. No source lists public exploit code. Fixed in pared 0.4.0.

What does this mean?
Severity
6.8 MediumCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.4.0pared +1 more

Description

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

  • pared::prc::Prc::from_rc
  • pared::prc::Prc::project
  • pared::prc::Prc::try_from_rc
  • pared::sync::Parc::from_arc
  • pared::sync::Parc::project
  • pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Affected packages

Affected packages
PackageAffectedFixed
pared
crates.io
before 0.4.0
0.4.0
pared
crates.io
0.0.0-0 up to 0.4.0
0.4.0

What each source reports

GitHub Advisories Score used6.8

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

  • pared::prc::Prc::from_rc
  • pared::prc::Prc::project
  • pared::prc::Prc::try_from_rc
  • pared::sync::Parc::from_arc
  • pared::sync::Parc::project
  • pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

Record
GHSA-vgmh-mqm4-8j88
CVSS 4.0
6.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-416
Updated
2026-11-02
OSV6.8

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

  • pared::prc::Prc::from_rc
  • pared::prc::Prc::project
  • pared::prc::Prc::try_from_rc
  • pared::sync::Parc::from_arc
  • pared::sync::Parc::project
  • pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

Record
GHSA-vgmh-mqm4-8j88
CVSS 4.0
6.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-416
Updated
2026-11-02
OSVRUSTSEC-2025-0016No score

Use after free in `Parc` and `Prc` due to missing lifetime constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

  • pared::prc::Prc::from_rc
  • pared::prc::Prc::project
  • pared::prc::Prc::try_from_rc
  • pared::sync::Parc::from_arc
  • pared::sync::Parc::project
  • pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

Record
RUSTSEC-2025-0016
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open