{"id":"RUSTSEC-2026-0205","aliases":[],"status":"published","title":"`Array::insert` violates exception safety if compare function panics, leading to potential Double-Free","description":"In affected versions of this crate, `Array::insert` is not exception safe. In the `UPSERT` path, `key` and `value`'s snapshot is written to `self.data_block`, and after the insertion is completed, `key` and `value` are `mem::forget` in order to prevent double free. However, during the insertion, `K::compare` is invoked, which is a user-provided method. If user deliberately call panic in this function, during unwinding, the destructors of `key`, `value`, and `self` will all be called (since the `mem::forget` has not been called yet), leading to Double Free. Similar issues happens in the `!UPSERT` path.\n\nThe soundness issue was fixed in version `3.8.4` by using `ManuallyDrop` instead of `mem::forget`, and separating fallible code from infallible code during a node split - insert = insert_try -\u003e insert_unchecked.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-06T12:00:00Z","modified":"2026-07-07T09:30:04Z","fixes":[{"ecosystem":"crates.io","package":"scc","fixed_in":["3.8.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"scc","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.8.4"}]}]}],"references":[{"url":"https://crates.io/crates/scc","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0205.html","tags":["advisory"]},{"url":"https://codeberg.org/wvwwvwwv/scalable-concurrent-containers/issues/232","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0205","title":"`Array::insert` violates exception safety if compare function panics, leading to potential Double-Free","description":"In affected versions of this crate, `Array::insert` is not exception safe. In the `UPSERT` path, `key` and `value`'s snapshot is written to `self.data_block`, and after the insertion is completed, `key` and `value` are `mem::forget` in order to prevent double free. However, during the insertion, `K::compare` is invoked, which is a user-provided method. If user deliberately call panic in this function, during unwinding, the destructors of `key`, `value`, and `self` will all be called (since the `mem::forget` has not been called yet), leading to Double Free. Similar issues happens in the `!UPSERT` path.\n\nThe soundness issue was fixed in version `3.8.4` by using `ManuallyDrop` instead of `mem::forget`, and separating fallible code from infallible code during a node split - insert = insert_try -\u003e insert_unchecked.","status":"published","published":"2026-07-06T12:00:00Z","modified":"2026-07-07T09:30:04.274635773Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}