GHSA-x6j6-3ffp-qrfr
Use-after-free in `clear` and `retain` when an element's `Drop` panics
GHSA-x6j6-3ffp-qrfr is a vulnerability with no CVSS score yet in skiplist, published September 2, 2026. No source lists public exploit code. Fixed in skiplist 1.1.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.1skiplist
Description
SkipList::clear drops the node chain and only then resets tail and len.
The drop runs each element's Drop, and T carries no bounds excluding a
panicking one. If it unwinds, tail still points at the freed node while len
stays non-zero.
back(), back_mut(), last_key_value() and last() dereference tail
through unsafe, so reading the container after the unwind is a use-after-free
(CWE-416). Drop for SkipList calls Box::from_raw on self.head, which
clear already destroyed, so dropping the container is a double free
(CWE-415).
retain, retain_mut and dedup_by reach the same state through
Node::filter_rebuild, which frees nodes and runs a user predicate before the
caller commits tail and len. There the head links are left partially
rewired, so traversal can also reach freed nodes.
Mitigation
Update to 1.1.1.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
skiplistcrates.io | 0.0.0-0 up to 1.1.1 | 1.1.1 |
What each source reports
OSVRUSTSEC-2026-0300No score
Use-after-free in `clear` and `retain` when an element's `Drop` panics
SkipList::clear drops the node chain and only then resets tail and len.
The drop runs each element's Drop, and T carries no bounds excluding a
panicking one. If it unwinds, tail still points at the freed node while len
stays non-zero.
back(), back_mut(), last_key_value() and last() dereference tail
through unsafe, so reading the container after the unwind is a use-after-free
(CWE-416). Drop for SkipList calls Box::from_raw on self.head, which
clear already destroyed, so dropping the container is a double free
(CWE-415).
retain, retain_mut and dedup_by reach the same state through
Node::filter_rebuild, which frees nodes and runs a user predicate before the
caller commits tail and len. There the head links are left partially
rewired, so traversal can also reach freed nodes.
Mitigation
Update to 1.1.1.
- Record
RUSTSEC-2026-0300- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.