{"id":"CVE-2018-20991","aliases":["EUVD-2021-1878","GHSA-rxr4-x558-x7hw","RUSTSEC-2018-0003","SUSE-SU-2021:1310-1","UBUNTU-CVE-2018-20991"],"status":"published","title":"Double free in smallvec","description":"An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01848,"percentile":0.79239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2018-07-19T12:00:00Z","modified":"2026-10-24T10:30:20Z","fixes":[{"ecosystem":"crates.io","package":"smallvec","fixed_in":["0.6.3","0.3.4","0.4.5","0.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"librsvg","fixed_in":["2.42.9-3.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.2"},{"fixed":"0.6.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.2"},{"fixed":"0.6.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.2"},{"fixed":"0.3.4"},{"introduced":"0.4.0-0"},{"fixed":"0.4.5"},{"introduced":"0.5.0-0"},{"fixed":"0.5.1"},{"introduced":"0.6.0-0"},{"fixed":"0.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9-3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.10-1","1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-2","1.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-1","1.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2-1","1.15.1-1"]}],"products":[{"vendor":"servo","product":"smallvec"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2018-0003.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20991","tags":["advisory"]},{"url":"https://github.com/servo/rust-smallvec/issues/96","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-rxr4-x558-x7hw"},{"url":"https://github.com/servo/rust-smallvec","tags":["package"]},{"url":"https://crates.io/crates/smallvec","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211310-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1148293","tags":["report"]},{"url":"https://bugzilla.suse.com/1181571","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20991","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-20991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20991","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-20991","description":"An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.","status":"published","published":"2019-08-26T14:23:19Z","modified":"2024-08-05T12:19:27.061Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2021-1878","description":"An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.","status":"published","published":"2019-08-26T14:23:19Z","modified":"2024-08-05T12:19:27Z","updated_at":"2026-11-03T02:39:28.311281Z"}],"ghsa":[{"id":"GHSA-rxr4-x558-x7hw","title":"Double free in smallvec","description":"If an iterator passed to SmallVec::insert_many panicked in Iterator::next, destructors were run during unwinding while the vector was in an inconsistent state, possibly causing a double free (a destructor running on two copies of the same value).\n\nThis is fixed in smallvec 0.6.3 by ensuring that the vector's length is not updated to include moved items until they have been removed from their original positions. Items may now be leaked if Iterator::next panics, but they will not be dropped more than once.","status":"published","published":"2021-08-25T20:42:54Z","modified":"2023-06-13T20:58:32Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2018-20991","description":"An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.","status":"published","published":"2019-08-26T15:15:11.39Z","modified":"2026-06-17T01:53:53.667Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:59.278647Z"}],"osv":[{"id":"CVE-2018-20991","description":"An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.","status":"published","published":"2019-08-26T15:15:11.39Z","modified":"2026-10-24T10:30:20.798906315Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"GHSA-rxr4-x558-x7hw","title":"Double free in smallvec","description":"If an iterator passed to SmallVec::insert_many panicked in Iterator::next, destructors were run during unwinding while the vector was in an inconsistent state, possibly causing a double free (a destructor running on two copies of the same value).\n\nThis is fixed in smallvec 0.6.3 by ensuring that the vector's length is not updated to include moved items until they have been removed from their original positions. Items may now be leaked if Iterator::next panics, but they will not be dropped more than once.","status":"published","published":"2021-08-25T20:42:54Z","modified":"2023-11-08T04:00:13.368337Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"RUSTSEC-2018-0003","title":"Possible double free during unwinding in SmallVec::insert_many","description":"If an iterator passed to `SmallVec::insert_many` panicked in `Iterator::next`,\ndestructors were run during unwinding while the vector was in an inconsistent\nstate, possibly causing a double free (a destructor running on two copies of\nthe same value).\n\nThis is fixed in smallvec 0.6.3 by ensuring that the vector's length is not\nupdated to include moved items until they have been removed from their\noriginal positions.  Items may now be leaked if `Iterator::next` panics, but\nthey will not be dropped more than once.\n\nThank you to [@Vurich](https://github.com/Vurich) for reporting this bug.","status":"published","published":"2018-07-19T12:00:00Z","modified":"2026-07-17T16:00:03.23978324Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2018-20991","description":"An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.","status":"published","published":"2019-08-26T15:15:00Z","modified":"2026-10-17T12:55:26.231704671Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"SUSE-SU-2021:1310-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issues:\n\n- librsvg was updated to 2.42.9:\n  * Update dependent crates that had security vulnerabilities:\n    smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2018-20991 (bsc#1148293)\n-the bundled version of the cssparser crate now builds correctly on Rust 1.43 (bsc#1181571).\n","status":"published","published":"2021-04-23T15:32:30Z","modified":"2026-02-04T02:18:43.910611Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}