{"id":"RUSTSEC-2026-0218","aliases":[],"status":"published","title":"`Enum` trait allows type confusion when manually implemented","description":"Affected versions of this crate did not require the element type of the `Array` associated type in the `Enum` trait to match the array's generic parameter `V`.\n\nThis can result in type confusion, and consequently memory corruption, when a manual `Enum` implementation declares an `Array\u003cV\u003e` whose elements are not actually of type `V`:\n\n```rust\nstruct IntentionallyWrong;\n\nimpl Enum for IntentionallyWrong {\n    type Array\u003cV\u003e = [String; 4];\n\n    fn from_usize(_: usize) -\u003e Self {\n        IntentionallyWrong\n    }\n\n    fn into_usize(self) -\u003e usize {\n        0\n    }\n}\n\nenum_map! { IntentionallyWrong =\u003e 42 };\n```\n\nThe flaw was corrected in commit [7a8b815432](https://codeberg.org/sugar700/enum-map/commit/7a8b8154323d426415a10accf104cd05c394cda9) by adding a `Value = V` bound to the `Array` type in the `Enum` trait.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-21T12:00:00Z","modified":"2026-07-28T18:45:04Z","fixes":[{"ecosystem":"crates.io","package":"enum-map","fixed_in":["3.1.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"enum-map","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0-0.gat.0"},{"fixed":"3.1.0"}]}]}],"references":[{"url":"https://crates.io/crates/enum-map","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0218.html","tags":["advisory"]},{"url":"https://codeberg.org/sugar700/enum-map/src/branch/master/CHANGELOG.md#version-310","tags":["web"]},{"url":"https://github.com/rustsec/advisory-db/issues/3060","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0218","title":"`Enum` trait allows type confusion when manually implemented","description":"Affected versions of this crate did not require the element type of the `Array` associated type in the `Enum` trait to match the array's generic parameter `V`.\n\nThis can result in type confusion, and consequently memory corruption, when a manual `Enum` implementation declares an `Array\u003cV\u003e` whose elements are not actually of type `V`:\n\n```rust\nstruct IntentionallyWrong;\n\nimpl Enum for IntentionallyWrong {\n    type Array\u003cV\u003e = [String; 4];\n\n    fn from_usize(_: usize) -\u003e Self {\n        IntentionallyWrong\n    }\n\n    fn into_usize(self) -\u003e usize {\n        0\n    }\n}\n\nenum_map! { IntentionallyWrong =\u003e 42 };\n```\n\nThe flaw was corrected in commit [7a8b815432](https://codeberg.org/sugar700/enum-map/commit/7a8b8154323d426415a10accf104cd05c394cda9) by adding a `Value = V` bound to the `Array` type in the `Enum` trait.","status":"published","published":"2026-07-21T12:00:00Z","modified":"2026-07-28T18:45:04.794215742Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}