Vulnerability RUSTSEC-2026-0528
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 days ago
November 12, 2026 at 12:00 PM UTC
UB can be reached from safe code
>=0.0.0-0 <0.1.3
>=0.0.0-0 <0.1.3
Summary
UB can be reached from safe code
Details
The variance of RefSwap and OptionRefSwap were incorrect, possibly allowing use-after-free.
OptionRefSwap::into_inner did not check for null.
The fix is to make RefSwap and OptionRefSwap invariant, and to change OptionRefSwap::into_inner to return an option. It is available in version 0.1.3. If your project still compiles with 0.1.3 then it is not affected by the unsoundness on version 0.1.2
Impacted packages
Timeline
Published
2 days ago
November 12, 2026 at 12:00 PM UTC
Fixed (0.1.3)
2 days ago
November 12, 2026 at 03:05 PM UTC
Last Modified
1 day ago
November 13, 2026 at 12:45 PM UTC