{"id":"RUSTSEC-2026-0291","aliases":[],"status":"published","title":"Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics","description":"`OwnedAlloc::drop_in_place` destroys the contained value by hand, then commits\nthe ownership transfer with `mem::forget(self)` — which lives inside `into_raw`\nand so runs only after the destruction. `T::drop` is user code and may panic. If\nit does, the forget is skipped and the still-live `OwnedAlloc` unwinds, whose\ndestructor drops the same `T` a second time and then deallocates. For a `T` that\nowns an allocation, the same block is freed twice — a double free (CWE-415).\nThat destructor also reads the already-destroyed value through\n`Layout::for_value` before deallocating, a use-after-free (CWE-416).\n\n`MaybeUninitAlloc::drop_in_place` delegates to the same function, so both public\nentry points are affected. Storing a value whose `Drop` can panic and calling\neither is enough — no `unsafe` on the caller's side.\n\n## Fix\n\nNo fixed release is available. The crate has had no release since 2018 and the\nmaintainer has not responded to the report, nor to the one on `lockfree`, which\nis published from the same account. `forget_inner` leaks the value instead of\ndestroying it, which is safe.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-09-09T12:00:00Z","modified":"2026-09-21T09:15:02Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"owned-alloc","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/owned-alloc","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0291.html","tags":["advisory"]},{"url":"https://gitlab.com/bzim/owned-alloc/-/issues/1","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0291","title":"Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics","description":"`OwnedAlloc::drop_in_place` destroys the contained value by hand, then commits\nthe ownership transfer with `mem::forget(self)` — which lives inside `into_raw`\nand so runs only after the destruction. `T::drop` is user code and may panic. If\nit does, the forget is skipped and the still-live `OwnedAlloc` unwinds, whose\ndestructor drops the same `T` a second time and then deallocates. For a `T` that\nowns an allocation, the same block is freed twice — a double free (CWE-415).\nThat destructor also reads the already-destroyed value through\n`Layout::for_value` before deallocating, a use-after-free (CWE-416).\n\n`MaybeUninitAlloc::drop_in_place` delegates to the same function, so both public\nentry points are affected. Storing a value whose `Drop` can panic and calling\neither is enough — no `unsafe` on the caller's side.\n\n## Fix\n\nNo fixed release is available. The crate has had no release since 2018 and the\nmaintainer has not responded to the report, nor to the one on `lockfree`, which\nis published from the same account. `forget_inner` leaks the value instead of\ndestroying it, which is safe.","status":"published","published":"2026-09-09T12:00:00Z","modified":"2026-09-21T09:15:02.893165285Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}