RUSTSEC-2026-0293
Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
Consumer::skip() and Consumer::clear() are not panic-safe. They drop the
consumed elements in place and only afterwards call advance_read_index() to move
the ring buffer's read index past them. If an element's Drop panics mid-loop,
advance_read_index() is never reached, so the read index still points at the
already-dropped elements. When the ring buffer is later dropped, its destructor
re-visits those slots and drops the same elements a second time — a double free
(CWE-415) / use-after-free (CWE-416) reachable from safe Rust, confirmed under
AddressSanitizer.
Consumer::clear() delegates to Consumer::skip(self.len()), so both share the
same root cause and the same fix.
Mitigation
Update to 0.5.2 or later (fixed in agerasev/ringbuf#60).
What each source reports
OSVNo score
Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
Consumer::skip() and Consumer::clear() are not panic-safe. They drop the
consumed elements in place and only afterwards call advance_read_index() to move
the ring buffer's read index past them. If an element's Drop panics mid-loop,
advance_read_index() is never reached, so the read index still points at the
already-dropped elements. When the ring buffer is later dropped, its destructor
re-visits those slots and drops the same elements a second time — a double free
(CWE-415) / use-after-free (CWE-416) reachable from safe Rust, confirmed under
AddressSanitizer.
Consumer::clear() delegates to Consumer::skip(self.len()), so both share the
same root cause and the same fix.
Mitigation
Update to 0.5.2 or later (fixed in agerasev/ringbuf#60).
- Record
RUSTSEC-2026-0293- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ringbufcrates.io | 0.0.0-0 up to 0.5.2 | 0.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0293 is a vulnerability with no CVSS score yet in ringbuf, published September 21, 2026. No source lists public exploit code. Fixed in ringbuf 0.5.2.