{"id":"GHSA-xphw-cqx3-667j","revision":null,"records":[{"revision":"f52f79583b314e88a19872be2bf4b278","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-6654","aliases":[],"title":"Use-After-Free and Double-Free in IntoIter::drop when element drop panics","description":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","state":0,"publishedAt":"2026-04-20T10:05:52.339+00:00","modifiedAt":"2026-07-15T00:41:16.23+00:00","affected":[{"ecosystem":"Vendor product","name":"thin-vec","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Mozilla\",\n                    \"product\": \"thin-vec\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"0.2.16\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"versionType\": \"rpm\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[],"references":["https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-6654","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-6654","identifiers":["CVE-2026-6654"]},"retained":false,"historicalAffected":[]},{"revision":"467a7db6cde9462f8560859cd633a520","observedAt":"2026-10-28T08:44:32.603+00:00","statement":{"source":"euvd","id":"EUVD-2026-23832","aliases":["CVE-2026-6654"],"title":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","description":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":7.3,"severity":null}],"references":["https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23832","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 20, 2026, 10:05:52 AM","dateUpdated":"Jul 15, 2026, 12:41:16 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-23832","identifiers":["EUVD-2026-23832","CVE-2026-6654"]},"retained":false,"historicalAffected":[]},{"revision":"b0d5956938f744cf94fff75f1b86a988","observedAt":"2026-10-27T15:46:32.124+00:00","statement":{"source":"nvd","id":"CVE-2026-6654","aliases":[],"title":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","description":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","state":0,"publishedAt":"2026-04-20T11:16:19.937+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":5.1,"severity":"MEDIUM"},{"system":"CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":5.1,"severity":"MEDIUM"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":7.3,"severity":"HIGH"}],"references":["https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j","https://access.redhat.com/security/cve/CVE-2026-6654","https://bugzilla.redhat.com/show_bug.cgi?id=2459689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6654.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6654","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-415","CWE-416","CWE-1341"],"productCriteria":["cpe:2.3:a:mozilla:thin-vec:0.2.15:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2026-04-20T11:16:19.937","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-6654","identifiers":["CVE-2026-6654"]},"retained":false,"historicalAffected":[]},{"revision":"a4ea70b36f614ffcb59e1a4d32ea68a5","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-xphw-cqx3-667j","aliases":["CVE-2026-6654","RUSTSEC-2026-0103"],"title":"thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics","description":"### Summary\n\nA **Double Free / Use-After-Free (UAF)** vulnerability has been identified in the `IntoIter::drop` and `ThinVec::clear` implementations of the `thin_vec` crate.\nBoth vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no `unsafe` blocks required.\nUndefined Behavior has been confirmed via **Miri** and **AddressSanitizer (ASAN)**.\n\n---\n\n### Details\n\nBoth vulnerabilities share the same root cause. When a **panic occurs** during sequential element deallocation, the subsequent length cleanup code (`set_len(0)`) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).\n\n#### Vulnerability 1 — `IntoIter::drop`\n\n**Location:** `thin-vec/src/lib.rs` L.2308~2314\n\n`IntoIter::drop` transfers ownership of the internal buffer via `mem::replace`, then sequentially frees elements via `ptr::drop_in_place`.\nIf a panic occurs during element deallocation, `set_len_non_singleton(0)` is never reached. During unwinding, `vec` is dropped again, re-freeing already-freed elements.\nThe standard library's `std::vec::IntoIter` prevents this with a **DropGuard pattern**, but thin-vec lacks this defense.\n\n```rust\n// Problematic structure (conceptual representation)\nimpl<T> Drop for IntoIter<T> {\n    fn drop(&mut self) {\n        let mut vec = mem::replace(&mut self.vec, ThinVec::new());\n        unsafe {\n            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here\n            vec.set_len_non_singleton(0);                  // ← unreachable on panic\n        }\n        // During unwinding, vec is dropped again → Double Free\n    }\n}\n```\n\n#### Vulnerability 2 — `ThinVec::clear`\n\n`clear()` calls `ptr::drop_in_place(&mut self[..])` followed by `self.set_len(0)` to reset the length.\nIf a panic occurs during element deallocation, `set_len(0)` is never executed. When the `ThinVec` itself is subsequently dropped, already-freed elements are freed again.\n\n```rust\n// Problematic structure (conceptual representation)\npub fn clear(&mut self) {\n    unsafe {\n        ptr::drop_in_place(&mut self[..]); // ← panic may occur here\n        self.set_len(0);                   // ← unreachable on panic\n    }\n    // ThinVec drop later → Double Free\n}\n```\n\n#### Recommended Fix\n\nBoth vulnerabilities can be resolved with the same pattern:\n\n- **DropGuard pattern:** Insert an RAII guard before `drop_in_place` to guarantee `set_len(0)` is called regardless of panic\n- **Pre-zeroing approach:** Set the length to 0 before calling `drop_in_place`\n\n---\n\n### PoC\n\n**Requirements:** Rust nightly toolchain, `thin-vec = \"0.2.14\"`\n\n```bash\n# Miri\ncargo +nightly miri run\n\n# ASAN\nRUSTFLAGS=\"-Z sanitizer=address\" cargo +nightly run --release\n```\n\n#### PoC-1: `IntoIter::drop`\n\n```rust\nuse thin_vec::ThinVec;\n\nstruct PanicBomb(String);\n\nimpl Drop for PanicBomb {\n    fn drop(&mut self) {\n        if self.0 == \"panic\" {\n            panic!(\"panic!\");\n        }\n        println!(\"Dropping: {}\", self.0);\n    }\n}\n\nfn main() {\n    let mut v = ThinVec::new();\n    v.push(PanicBomb(String::from(\"normal1\")));\n    v.push(PanicBomb(String::from(\"panic\")));  // trigger element\n    v.push(PanicBomb(String::from(\"normal2\")));\n\n    let mut iter = v.into_iter();\n    iter.next();\n    // When iter is dropped: panic occurs at \"panic\" element\n    // → During unwinding, Double Drop is triggered on \"normal1\" (already freed)\n}\n```\n\n**Miri output:**\n```\nerror: Undefined Behavior: pointer not dereferenceable:\n       alloc227 has been freed, so this pointer is dangling\n\nstack backtrace:\n   3: <PanicBomb as Drop>::drop           ← Double Drop entry\n   6: <ThinVec<T> as Drop>::drop::drop_non_singleton\n   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)\n```\n\n**ASAN output:**\n```\n==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010\nREAD of size 7 at 0x7afa685e0010\n    #0 memcpy\n    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point\n    #5 <ThinVec as Drop>::drop::drop_non_singleton\n    #6 <IntoIter as Drop>::drop::drop_non_singleton\n```\n\n#### PoC-2: `ThinVec::clear`\n\n```rust\nuse thin_vec::ThinVec;\nuse std::panic;\n\nstruct Poison(Box<usize>, &'static str);\n\nimpl Drop for Poison {\n    fn drop(&mut self) {\n        if self.1 == \"panic\" {\n            panic!(\"panic!\");\n        }\n        println!(\"Dropping: {}\", self.0);\n    }\n}\n\nfn main() {\n    let mut v = ThinVec::new();\n    v.push(Poison(Box::new(1), \"normal1\")); // index 0\n    v.push(Poison(Box::new(2), \"panic\"));   // index 1 → panic triggered here\n    v.push(Poison(Box::new(3), \"normal2\")); // index 2\n\n    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {\n        v.clear();\n        // panic occurs at \"panic\" element during clear()\n        // → set_len(0) is never called\n        // → already-freed elements are re-freed when v goes out of scope\n    }));\n}\n```\n\n---\n\n### Impact\n\n**Vulnerability classification:**\n- CWE-415: Double Free\n- CWE-416: Use-After-Free\n\n**Affected code:** All code satisfying the following conditions simultaneously:\n\n1. `ThinVec` stores heap-owning types (`String`, `Vec`, `Box`, etc.)\n2. (Vulnerability 1) An iterator is created via `into_iter()` and dropped before being fully consumed, or\n   (Vulnerability 2) `clear()` is called while a remaining element's `Drop` implementation can panic\n3. The `Drop` implementation of a remaining element triggers a panic\n\nAdditionally, when combined with `Box<dyn Trait>` types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.","state":0,"publishedAt":"2026-04-15T19:24:54+00:00","modifiedAt":"2026-09-10T03:50:44.9868284+00:00","affected":[{"ecosystem":"crates.io","name":"thin-vec","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.2.16"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j","https://nvd.nist.gov/vuln/detail/CVE-2026-6654","https://github.com/mozilla/thin-vec","https://rustsec.org/advisories/RUSTSEC-2026-0103.html"],"sourceUrl":"https://github.com/advisories/GHSA-xphw-cqx3-667j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xphw-cqx3-667j","identifiers":["GHSA-xphw-cqx3-667j","CVE-2026-6654","RUSTSEC-2026-0103"]},"retained":false,"historicalAffected":[]},{"revision":"d7f7c6c834924a76823d0c10ded61db3","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0103","aliases":["CVE-2026-6654","GHSA-xphw-cqx3-667j"],"title":"Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics","description":"A Double Free / Use-After-Free (UAF) vulnerability has been identified in the\n`IntoIter::drop` and `ThinVec::clear` implementations of the `thin-vec` crate.\nBoth vulnerabilities share the same root cause and can trigger memory\ncorruption using only safe Rust code - no unsafe blocks required. Undefined\nBehavior has been confirmed via Miri and AddressSanitizer (ASAN).\n\n## Details\n\nWhen a **panic occurs** during sequential element deallocation, the subsequent\nlength cleanup code (`set_len(0)`) is never executed. During stack unwinding,\nthe container is dropped again, causing already-freed memory to be re-freed\n(Double Free / UAF).\n\n### Vulnerability 1 - `IntoIter::drop`\n\n`IntoIter::drop` transfers ownership of the internal buffer via `mem::replace`,\nthen sequentially frees elements via `ptr::drop_in_place`. If a panic occurs\nduring element deallocation, `set_len_non_singleton(0)` is never reached.\nDuring unwinding, `vec` is dropped again, re-freeing already-freed elements.\nThe standard library's `std::vec::IntoIter` prevents this with a **DropGuard\npattern**, but thin-vec lacks this defense.\n\n### PoC\n\n```rust\nuse thin_vec::ThinVec;\n\nstruct PanicBomb(String);\n\nimpl Drop for PanicBomb {\n    fn drop(&mut self) {\n        if self.0 == \"panic\" {\n            panic!(\"panic!\");\n        }\n        println!(\"Dropping: {}\", self.0);\n    }\n}\n\nfn main() {\n    let mut v = ThinVec::new();\n    v.push(PanicBomb(String::from(\"normal1\")));\n    v.push(PanicBomb(String::from(\"panic\")));  // trigger element\n    v.push(PanicBomb(String::from(\"normal2\")));\n\n    let mut iter = v.into_iter();\n    iter.next();\n    // When iter is dropped: panic occurs at \"panic\" element\n    // → During unwinding, Double Drop is triggered on \"normal1\" (already freed)\n}\n```\n\n### Vulnerability 2 - `ThinVec::clear`\n\n`clear()` calls `ptr::drop_in_place(&mut self[..])` followed by\n`self.set_len(0)` to reset the length. If a panic occurs during element\ndeallocation, `set_len(0)` is never executed. When the `ThinVec` itself is\nsubsequently dropped, already-freed elements are freed again.\n\n### PoC\n\n```rust\nuse thin_vec::ThinVec;\nuse std::panic;\n\nstruct Poison(Box<usize>, &'static str);\n\nimpl Drop for Poison {\n    fn drop(&mut self) {\n        if self.1 == \"panic\" {\n            panic!(\"panic!\");\n        }\n        println!(\"Dropping: {}\", self.0);\n    }\n}\n\nfn main() {\n    let mut v = ThinVec::new();\n    v.push(Poison(Box::new(1), \"normal1\")); // index 0\n    v.push(Poison(Box::new(2), \"panic\"));   // index 1 → panic triggered here\n    v.push(Poison(Box::new(3), \"normal2\")); // index 2\n\n    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {\n        v.clear();\n        // panic occurs at \"panic\" element during clear()\n        // → set_len(0) is never called\n        // → already-freed elements are re-freed when v goes out of scope\n    }));\n}\n```\n\n## Prerequisites\n\n1. `ThinVec` stores heap-owning types (`String`, `Vec`, `Box`, etc.)\n2. (Vulnerability 1) An iterator is created via `into_iter()` and dropped before being fully consumed, or\n   (Vulnerability 2) `clear()` is called while a remaining element's `Drop` implementation can panic\n3. The `Drop` implementation of a remaining element triggers a panic\n\nWhen combined with `Box<dyn Trait> types`, an exploit primitive enabling\nArbitrary Code Execution (ACE) via heap spray and vtable hijacking has been\nconfirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop\nis reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can\nbe redirected to attacker-controlled code.","state":0,"publishedAt":"2026-04-14T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:08.2280434+00:00","affected":[{"ecosystem":"crates.io","name":"thin-vec","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.2.16"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/thin-vec","https://rustsec.org/advisories/RUSTSEC-2026-0103.html","https://github.com/mozilla/thin-vec/commit/df64748355222525c344ecd9d2c9f59a662e1678"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0103","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0103","identifiers":["RUSTSEC-2026-0103","CVE-2026-6654","GHSA-xphw-cqx3-667j"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T04:49:00.5013535+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T04:49:00.5013535+00:00","lastSuccessAt":"2026-10-30T04:49:00.6414495+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.6414504+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-2e71aeeaba1e737812d17410e1484919534917ed0495906eec4eca846085ee8f","complete":true,"records":416922,"lastAttemptAt":"2026-10-30T04:48:59.4263515+00:00","lastSuccessAt":"2026-10-30T04:48:59.3474102+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:48:59.4263515+00:00","snapshotPublishedAt":"2026-10-30T04:27:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2897fb2ade7642b5a71112974bcfc1c1","complete":false,"records":13518,"lastAttemptAt":"2026-10-30T05:01:03.5048342+00:00","lastSuccessAt":"2026-10-30T05:01:03.492+00:00","error":"23 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T05:01:03.492+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13143,"expectedIdentifiers":13601,"failedIdentifiers":23},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T04:49:00.5013535+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T04:49:00.5013535+00:00","lastSuccessAt":"2026-10-30T04:49:00.6424189+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.6424193+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dff131a3390246408db17133f034dc7f","complete":true,"records":13541,"lastAttemptAt":"2026-10-30T04:49:01.1833908+00:00","lastSuccessAt":"2026-10-30T03:49:22.155+00:00","error":null,"lastVerifiedAt":"2026-10-30T03:49:22.155+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13601,"expectedIdentifiers":13601,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-ed3d9cf8b8585536fcb9b5cdf9f82e66117dc54e56de651034444f578191d1cf","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T04:49:00.0803085+00:00","lastSuccessAt":"2026-10-30T03:49:17.6553909+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.0803085+00:00","snapshotPublishedAt":"2026-10-30T03:03:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T04:48:59.5832538+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:48:59.5832538+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3d73c87158b66efc3d2abd577048eff6d8962b9b8404ac23159c8b20cd3852a7","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T04:49:00.4664018+00:00","lastSuccessAt":"2026-10-30T03:49:20.7978659+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.4664018+00:00","snapshotPublishedAt":"2026-10-30T03:03:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T04:48:59.9718614+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:48:59.9718614+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}