{"id":"RUSTSEC-2026-0078","aliases":[],"status":"published","title":"Symbol confusion after hasher panic in `intaglio` interners","description":"Affected versions of this crate can leave all `SymbolTable` variants in an\ninternally inconsistent state if a custom `BuildHasher` panics during\n`HashMap::insert` and the caller recovers with `catch_unwind`.\n\nThe `intern` implementations committed a `vec.push(...)` before the matching\n`map.insert(...)` completed. If hashing panicked in that window, later lookups\nand inserts could observe diverging `vec` and `map` lengths.\n\nIn release builds, this can lead to symbol confusion where a newly interned\nstring resolves to previously interned attacker-controlled contents. In debug\nbuilds, the same corruption is detected by follow-up assertions and results in\npanics.\n\nThe flaw was corrected in version 1.13.3 by making the `vec` mutation\ntransactional across unwind boundaries so partially inserted entries are rolled\nback before the panic propagates.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-03-30T12:00:00Z","modified":"2026-04-25T07:30:06Z","fixes":[{"ecosystem":"crates.io","package":"intaglio","fixed_in":["1.13.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"intaglio","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.13.3"}]}]}],"references":[{"url":"https://crates.io/crates/intaglio","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0078.html","tags":["advisory"]},{"url":"https://github.com/artichoke/intaglio/issues/359","tags":["report"]},{"url":"https://github.com/artichoke/intaglio/pull/360","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0078","title":"Symbol confusion after hasher panic in `intaglio` interners","description":"Affected versions of this crate can leave all `SymbolTable` variants in an\ninternally inconsistent state if a custom `BuildHasher` panics during\n`HashMap::insert` and the caller recovers with `catch_unwind`.\n\nThe `intern` implementations committed a `vec.push(...)` before the matching\n`map.insert(...)` completed. If hashing panicked in that window, later lookups\nand inserts could observe diverging `vec` and `map` lengths.\n\nIn release builds, this can lead to symbol confusion where a newly interned\nstring resolves to previously interned attacker-controlled contents. In debug\nbuilds, the same corruption is detected by follow-up assertions and results in\npanics.\n\nThe flaw was corrected in version 1.13.3 by making the `vec` mutation\ntransactional across unwind boundaries so partially inserted entries are rolled\nback before the panic propagates.","status":"published","published":"2026-03-30T12:00:00Z","modified":"2026-04-25T07:30:06.20138Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}