{"id":"RUSTSEC-2026-0309","aliases":[],"status":"published","title":"`SinglyLinkedList::remove` dereferences a null link","description":"In versions before 0.2.1, `SinglyLinkedList::remove` is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when `node` is not in the list, `(*current_elm).next` reads a null pointer. That is undefined behavior. The list head is a raw `*mut Node\u003cT\u003e`, and safe code can construct the empty list.\n\nThe maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional `assert!` before the pointer is followed, matching the upstream Zig `unwrap` on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-20T12:00:00Z","modified":"2026-09-25T18:00:04Z","fixes":[{"ecosystem":"crates.io","package":"bun_collections","fixed_in":["0.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"bun_collections","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.1"}]}]}],"references":[{"url":"https://crates.io/crates/bun_collections","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0309.html","tags":["advisory"]},{"url":"https://github.com/putao520/bao/issues/46","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0309","title":"`SinglyLinkedList::remove` dereferences a null link","description":"In versions before 0.2.1, `SinglyLinkedList::remove` is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when `node` is not in the list, `(*current_elm).next` reads a null pointer. That is undefined behavior. The list head is a raw `*mut Node\u003cT\u003e`, and safe code can construct the empty list.\n\nThe maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional `assert!` before the pointer is followed, matching the upstream Zig `unwrap` on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.","status":"published","published":"2026-09-20T12:00:00Z","modified":"2026-09-25T18:00:04.471289722Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}