{"id":"RUSTSEC-2026-0302","revision":null,"records":[{"revision":"5e60fbf3cbbf4dddbbf2b788c5ce809e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0302","aliases":[],"title":"`stack-graphs` C API exports are safe `extern \"C\"` functions","description":"`stack_graphs::c` is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are `pub extern \"C\" fn` rather than `unsafe fn`. Safe Rust can call them.\n\n`sg_stack_graph_free` frees the pointer with `Box::from_raw`. `sg_stack_graph_free(std::ptr::null_mut())` is immediate undefined behavior. The same shape is used by the other `*_free` exports and by getters and mutators that dereference the caller-supplied pointer or pass it to `from_raw_parts` (`sg_stack_graph_nodes`, `sg_stack_graph_add_edges`, and the rest of the pointer-taking functions in `src/c.rs`). Constructors that take no pointer are not part of this issue.\n\nThe upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export `unsafe extern \"C\" fn`, with a safety comment that the pointer is non-null and, for `free`, came from the matching constructor.","state":0,"publishedAt":"2026-09-22T12:00:00+00:00","modifiedAt":"2026-09-22T21:00:02.8795157+00:00","affected":[{"ecosystem":"crates.io","name":"stack-graphs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.3-0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/stack-graphs","https://rustsec.org/advisories/RUSTSEC-2026-0302.html","https://github.com/rustsec/advisory-db/issues/3241","https://github.com/github/stack-graphs"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0302","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0302","identifiers":["RUSTSEC-2026-0302"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T21:16:34.5730792+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T21:16:34.5730792+00:00","lastSuccessAt":"2026-11-12T21:16:34.7781818+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.7781851+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-203e202fbd67c0cbc347ba020411be78e9e154b4ca5912ba08a1c1b61a3b79e8","complete":true,"records":424847,"lastAttemptAt":"2026-11-12T21:16:24.9956006+00:00","lastSuccessAt":"2026-11-12T21:16:24.6892247+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:24.9956006+00:00","snapshotPublishedAt":"2026-11-12T20:19:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c9dbdb2aeb7648948ea95ad430acbfcd","complete":false,"records":13780,"lastAttemptAt":"2026-11-12T21:17:21.6046679+00:00","lastSuccessAt":"2026-11-12T21:17:21.6632578+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:17:21.6632578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T21:16:34.5730792+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T21:16:34.5730792+00:00","lastSuccessAt":"2026-11-12T21:16:34.7790575+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.7790576+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c7da84f937d546f9bc47709812462004","complete":false,"records":13780,"lastAttemptAt":"2026-11-12T21:17:00.3939011+00:00","lastSuccessAt":"2026-11-12T21:17:00.39+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:17:00.39+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13830,"expectedIdentifiers":13833,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0db4c534aaa8e6aa34cb4db66b1c3dbcd45a9d81a0f263fa9d438e08e81869b0","complete":true,"records":9952,"lastAttemptAt":"2026-11-12T21:16:34.5223929+00:00","lastSuccessAt":"2026-11-12T21:16:34.1869923+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.5223929+00:00","snapshotPublishedAt":"2026-11-12T21:03:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T21:16:25.0464832+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:25.0464832+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T21:16:34.5377517+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:34.5377517+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-aacb2ea0a84f684226fd5e421ed31635112d695f522f1d5914b6afab8cc7f03c","complete":true,"records":231724,"lastAttemptAt":"2026-11-12T21:16:25.1509038+00:00","lastSuccessAt":"2026-11-12T20:18:18.1230476+00:00","error":null,"lastVerifiedAt":"2026-11-12T21:16:25.1509038+00:00","snapshotPublishedAt":"2026-11-12T19:33:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}