GHSA-wm8x-php5-hvq6
Maligned causes incorrect deallocation
maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.
GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.
When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.
What each source reports
GitHub Advisories No score
Maligned causes incorrect deallocation
maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.
GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.
When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.
- Record
GHSA-wm8x-php5-hvq6- Updated
- 2026-11-02
OSV No score
Maligned causes incorrect deallocation
maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.
GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.
When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.
- Record
GHSA-wm8x-php5-hvq6- Updated
- 2026-11-02
OSVRUSTSEC-2023-0017 No score
`maligned::align_first` causes incorrect deallocation
maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.
GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.
When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.
- Record
RUSTSEC-2023-0017- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wm8x-php5-hvq6 is a vulnerability with no CVSS score yet in maligned, published March 4, 2023. No source lists public exploit code. No source names a fixed version.