{"id":"GHSA-xqjr-wfx3-gmxv","aliases":["RUSTSEC-2025-0054"],"status":"published","title":"ArrayQueue's push_front is not panic-safe","description":"The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.\n\nSpecifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.\n\nThe bug was fixed in commit `728fe1b`.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665"],"published":"2025-08-14T12:00:00Z","modified":"2025-10-28T06:29:27Z","fixes":[{"ecosystem":"crates.io","package":"array-queue","fixed_in":["0.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"array-queue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"array-queue","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"array-queue","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.4.0"}]}]}],"references":[{"url":"https://github.com/raviqqe/array-queue/issues/3","tags":["web","report"]},{"url":"https://github.com/raviqqe/array-queue/commit/728fe1bdffb04896d218e962d989a2ae6bf1ea92","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0054.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xqjr-wfx3-gmxv"},{"url":"https://github.com/raviqqe/array-queue","tags":["package"]},{"url":"https://crates.io/crates/array-queue","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-xqjr-wfx3-gmxv","title":"ArrayQueue's push_front is not panic-safe","description":"The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.\n\nSpecifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.\n\nThe bug was fixed in commit `728fe1b`.","status":"published","published":"2025-09-02T17:35:16Z","modified":"2025-09-02T17:35:17Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"osv":[{"id":"GHSA-xqjr-wfx3-gmxv","title":"ArrayQueue's push_front is not panic-safe","description":"The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.\n\nSpecifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.\n\nThe bug was fixed in commit `728fe1b`.","status":"published","published":"2025-09-02T17:35:16Z","modified":"2025-10-28T06:29:27.045607Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"RUSTSEC-2025-0054","title":"ArrayQueue::push_front is not panic-safe","description":"The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.\n\nSpecifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.\n\nThe bug was fixed in commit `728fe1b`.","status":"published","published":"2025-08-14T12:00:00Z","modified":"2025-10-28T06:29:27.045607Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}