Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Two independent soundness problems, both reachable from safe Rust. `Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by hand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is user code and may panic. If it does, `mem::forget(self)` is skipped and the still-live `Map` unwinds, whose field drop glue destroys `builder` a second time. An empty map is enough — no entries or concurrency required. `SharedIncin::clear` writes `mem::uninitialized::<Arc<_>>()` into `self.inner` before taking the real `Arc` out. `Arc` has a validity invariant, so this is undefined behaviour at the point of creation, with no panic or concurrency involved. Between that write and the repairing one, `self.inner` also holds garbage while `self` is still droppable, so an unwind from `incin.clear()` or `Arc::new` decrements a refcount through an uninitialized pointer. The `make_shared_incin!` macro is instantiated five times, so this covers `queue`, `stack`, `map`, `channel::spmc` and `channel::mpmc`. ## Impact * CWE-415 (Double Free): the same allocation is freed twice. * CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`. * CWE-908 (Use of Uninitialized Resource): an `Arc` is constructed from uninitialized bytes. ## Fix No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.

Source published

26 Aug 2026 12:00:00 UTC

Source modified

14 Sep 2026 10:00:03 UTC

Saved here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.