{"id":"GHSA-7hc7-h3f2-r4j6","aliases":["RUSTSEC-2026-0242"],"status":"published","title":"Safe ErrorRegistry APIs can cause undefined behavior","description":"All published versions of `dcrypt-api` before 2.0.0 exposed safe\n`ErrorRegistry` operations that could trigger undefined behavior when the\ndefault `std` feature was enabled.\n\nStored `Box\u003cE\u003e` values were erased to raw pointers and later deallocated as\n`Box\u003c()\u003e`. The `get_error\u003cE\u003e` operation also performed an unchecked cast to a\ncaller-selected type. Finally, concurrent replacement or clearing could free a\nvalue while another thread cloned it. Ordinary safe Rust could therefore cause\nmismatched deallocation, type confusion, and use-after-free. Crates that\nre-exported this API are affected transitively.\n\nVersion 2.0.0 replaces the raw pointers with owned `Box\u003cdyn Any + Send\u003e` values\nbehind a mutex, performs checked downcasts, and uses a mutation generation so\nconcurrent stores and clears win safely. There is no reliable workaround while\ncalling the affected registry API. Upgrade to 2.0.0 or later and avoid\nprocess-global error state where possible.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-09T12:00:00Z","modified":"2026-10-12T18:00:14Z","fixes":[{"ecosystem":"crates.io","package":"dcrypt-api","fixed_in":["2.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"dcrypt-api","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.0.0"}]}]}],"references":[{"url":"https://crates.io/crates/dcrypt-api","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0242.html","tags":["advisory"]},{"url":"https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8","tags":["web"]},{"url":"https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0242","title":"Safe ErrorRegistry APIs can cause undefined behavior","description":"All published versions of `dcrypt-api` before 2.0.0 exposed safe\n`ErrorRegistry` operations that could trigger undefined behavior when the\ndefault `std` feature was enabled.\n\nStored `Box\u003cE\u003e` values were erased to raw pointers and later deallocated as\n`Box\u003c()\u003e`. The `get_error\u003cE\u003e` operation also performed an unchecked cast to a\ncaller-selected type. Finally, concurrent replacement or clearing could free a\nvalue while another thread cloned it. Ordinary safe Rust could therefore cause\nmismatched deallocation, type confusion, and use-after-free. Crates that\nre-exported this API are affected transitively.\n\nVersion 2.0.0 replaces the raw pointers with owned `Box\u003cdyn Any + Send\u003e` values\nbehind a mutex, performs checked downcasts, and uses a mutation generation so\nconcurrent stores and clears win safely. There is no reliable workaround while\ncalling the affected registry API. Upgrade to 2.0.0 or later and avoid\nprocess-global error state where possible.","status":"published","published":"2026-08-09T12:00:00Z","modified":"2026-10-12T18:00:14.905021984Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}