GitHub Advisoryadvisory · crates.io

GHSA-x43w-ph7m-pfjx hexchat crate has a Use After Free vulnerability

HIGH Published 2026-02-25 Modified 2026-02-25 Official page ↗

Ecosystem: crates.io
Packages: hexchat
Severity: High
CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses: CWE-416
Reviewed: 2026-02-25

Affected packages

• crates.io hexchat: <= 0.6.3 (no fix yet)

Description

All versions of this crate have function `deregister_command` which can result in use after free. This is unsound. In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads. In addition, the `hexchat` crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.

Weakness · CWE (1)

CWE-416 Use After Free weakness

References

https://github.com/pie-flavor/hexchat-rs/issues/3 web
https://github.com/pie-flavor/hexchat-rs package
https://rustsec.org/advisories/RUSTSEC-2025-0153.html web

GHSA-x43w-ph7m-pfjx hexchat crate has a Use After Free vulnerability

Affected packages

Description

Related

Weakness · CWE (1)

References