{"id":"RUSTSEC-2026-0252","aliases":[],"status":"published","title":"Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)","description":"`SplitVec::extend_from_slice` increments the logical length `self.len` before cloning the incoming elements into the reserved slots. If an element's `Clone` panics mid-fill, unwinding leaves `self.len` counting slots that were never initialized. A later safe read (`get`, indexing, `iter`) then reads one of those uninitialized slots.\n\nThis is reachable from safe Rust — a read of uninitialized memory (CWE-908). It is not a double-free: `SplitVec` has no manual `Drop` and its elements live in a standard `Vec`, so the defect is a read, not a free.\n\n## Impact\n\nA safe read after the panic returns a value built from uninitialized bytes. For a heap-owning element type such as `String`, the resulting value has garbage length/pointer fields.\n\nConfirmed under Miri. AddressSanitizer stays silent for this class, since the uninitialized bytes are consumed as a non-dereferenced field rather than an invalid load or free.\n\n## Fix\n\nFixed in `orx-split-vec` 4.0.0, which no longer commits the length before the elements are cloned.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-11T12:00:00Z","modified":"2026-08-11T10:45:03Z","fixes":[{"ecosystem":"crates.io","package":"orx-split-vec","fixed_in":["4.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"orx-split-vec","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"4.0.0"}]}]}],"references":[{"url":"https://crates.io/crates/orx-split-vec","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0252.html","tags":["advisory"]},{"url":"https://github.com/orxfun/orx-split-vec/issues/95","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0252","title":"Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)","description":"`SplitVec::extend_from_slice` increments the logical length `self.len` before cloning the incoming elements into the reserved slots. If an element's `Clone` panics mid-fill, unwinding leaves `self.len` counting slots that were never initialized. A later safe read (`get`, indexing, `iter`) then reads one of those uninitialized slots.\n\nThis is reachable from safe Rust — a read of uninitialized memory (CWE-908). It is not a double-free: `SplitVec` has no manual `Drop` and its elements live in a standard `Vec`, so the defect is a read, not a free.\n\n## Impact\n\nA safe read after the panic returns a value built from uninitialized bytes. For a heap-owning element type such as `String`, the resulting value has garbage length/pointer fields.\n\nConfirmed under Miri. AddressSanitizer stays silent for this class, since the uninitialized bytes are consumed as a non-dereferenced field rather than an invalid load or free.\n\n## Fix\n\nFixed in `orx-split-vec` 4.0.0, which no longer commits the length before the elements are cloned.","status":"published","published":"2026-08-11T12:00:00Z","modified":"2026-08-11T10:45:03.244815765Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}