{"id":"RUSTSEC-2026-0309","revision":"d11cd69598e54f3d9ffde460c14cb2fb","records":[{"revision":"d11cd69598e54f3d9ffde460c14cb2fb","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0309","aliases":[],"title":"`SinglyLinkedList::remove` dereferences a null link","description":"In versions before 0.2.1, `SinglyLinkedList::remove` is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when `node` is not in the list, `(*current_elm).next` reads a null pointer. That is undefined behavior. The list head is a raw `*mut Node<T>`, and safe code can construct the empty list.\n\nThe maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional `assert!` before the pointer is followed, matching the upstream Zig `unwrap` on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.","state":0,"publishedAt":"2026-09-20T12:00:00+00:00","modifiedAt":"2026-09-25T18:00:04.4712897+00:00","affected":[{"ecosystem":"crates.io","name":"bun_collections","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.2.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/bun_collections","https://rustsec.org/advisories/RUSTSEC-2026-0309.html","https://github.com/putao520/bao/issues/46"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0309","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0309","identifiers":["RUSTSEC-2026-0309"]},"retained":false,"historicalAffected":[]}],"coverage":[]}