RUSTSEC-2026-0302
`stack-graphs` C API exports are safe `extern "C"` functions
stack_graphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them.
sg_stack_graph_free frees the pointer with Box::from_raw. sg_stack_graph_free(std::ptr::null_mut()) is immediate undefined behavior. The same shape is used by the other *_free exports and by getters and mutators that dereference the caller-supplied pointer or pass it to from_raw_parts (sg_stack_graph_nodes, sg_stack_graph_add_edges, and the rest of the pointer-taking functions in src/c.rs). Constructors that take no pointer are not part of this issue.
The upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export unsafe extern "C" fn, with a safety comment that the pointer is non-null and, for free, came from the matching constructor.
What each source reports
OSV No score
`stack-graphs` C API exports are safe `extern "C"` functions
stack_graphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them.
sg_stack_graph_free frees the pointer with Box::from_raw. sg_stack_graph_free(std::ptr::null_mut()) is immediate undefined behavior. The same shape is used by the other *_free exports and by getters and mutators that dereference the caller-supplied pointer or pass it to from_raw_parts (sg_stack_graph_nodes, sg_stack_graph_add_edges, and the rest of the pointer-taking functions in src/c.rs). Constructors that take no pointer are not part of this issue.
The upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export unsafe extern "C" fn, with a safety comment that the pointer is non-null and, for free, came from the matching constructor.
- Record
RUSTSEC-2026-0302- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
stack-graphscrates.io |
0.0.3-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0302 is a vulnerability with no CVSS score yet in stack-graphs, published September 22, 2026. No source lists public exploit code. No source names a fixed version.