RUSTSEC-2026-0309
`SinglyLinkedList::remove` dereferences a null link
In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, (*current_elm).next reads a null pointer. That is undefined behavior. The list head is a raw *mut Node<T>, and safe code can construct the empty list.
The maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional assert! before the pointer is followed, matching the upstream Zig unwrap on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.
What each source reports
OSVNo score
`SinglyLinkedList::remove` dereferences a null link
In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, (*current_elm).next reads a null pointer. That is undefined behavior. The list head is a raw *mut Node<T>, and safe code can construct the empty list.
The maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional assert! before the pointer is followed, matching the upstream Zig unwrap on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.
- Record
RUSTSEC-2026-0309- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bun_collectionscrates.io | 0.0.0-0 up to 0.2.1 | 0.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0309 is a vulnerability with no CVSS score yet in bun_collections, published September 20, 2026. No source lists public exploit code. Fixed in bun_collections 0.2.1.