GitHub Advisoryadvisory · crates.io

GHSA-rhfx-m35p-ff5j `IterMut` violates Stacked Borrows by invalidating internal pointer

LOW Published 2026-01-07 Modified 2026-01-07 Official page ↗
Ecosystem
crates.io
Packages
lru
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-476
Reviewed
2026-01-07

Affected packages

• crates.io lru: >= 0.9.0, < 0.16.3 → fixed in 0.16.3

Description

Affected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer. This invalidates the shared pointer held by the internal `HashMap`, violating Stacked Borrows rules.

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References