{"answers":{"affected":"3 open source packages ship an affected version, including bumpalo.","exploited":"There is no known exploitation of GHSA-f85w-wvc7-crwc in the wild and no public exploit code.","fix":"Upgrade bumpalo to 3.11.1 or later.","what":"GHSA-f85w-wvc7-crwc is an use after free vulnerability in bumpalo, published on 14 Jan 2022."},"fix_prompt":"Check this codebase for GHSA-f85w-wvc7-crwc and fix it if it is affected.\n\nWhat it is: GHSA-f85w-wvc7-crwc is an use after free vulnerability in bumpalo, published on 14 Jan 2022. \nExploitation: There is no known exploitation of GHSA-f85w-wvc7-crwc in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- bumpalo (crates.io): affected from 1.1.0; fixed in 3.11.1\n- bumpalo (crates.io): affected from 1.1.0; fixed in 3.11.1\n- bumpalo (crates.io): affected from 1.1.0; fixed in 3.11.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-f85w-wvc7-crwc/ (Markdown: https://insights.sbomify.com/GHSA-f85w-wvc7-crwc/index.md)","id":"GHSA-f85w-wvc7-crwc","markdown":"https://insights.sbomify.com/GHSA-f85w-wvc7-crwc/index.md","name":"GHSA-f85w-wvc7-crwc","record":{"aliases":["RUSTSEC-2022-0078"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust memory allocator","requires_auth":"none","summary":"A lifetime error in bumpalo's Vec::into_iter allows use-after-free, potentially leading to memory corruption or crashes when the allocator is dropped.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In affected versions of this crate, the lifetime of the iterator produced by `Vec::into_iter()` is not constrained to the lifetime of the `Bump` that allocated the vector's memory. Using the iterator after the `Bump` is dropped causes use-after-free accesses.\n\nThe following example demonstrates memory corruption arising from a misuse of this unsoundness.\n\n```rust\nuse bumpalo::{collections::Vec, Bump};\n\nfn main() {\n    let bump = Bump::new();\n    let mut vec = Vec::new_in(\u0026bump);\n    vec.extend([0x01u8; 32]);\n    let into_iter = vec.into_iter();\n    drop(bump);\n\n    for _ in 0..100 {\n        let reuse_bump = Bump::new();\n        let _reuse_alloc = reuse_bump.alloc([0x41u8; 10]);\n    }\n\n    for x in into_iter {\n        print!(\"0x{:02x} \", x);\n    }\n    println!();\n}\n```\n\nThe issue was corrected in version 3.11.1 by adding a lifetime to the `IntoIter` type, and updating the signature of `Vec::into_iter()` to constrain this lifetime.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`","id":"GHSA-f85w-wvc7-crwc","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2022"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["3.11.1"],"introduced":["1.1.0"],"last_affected":[],"package":"bumpalo","purl":null,"source":"GHSA-f85w-wvc7-crwc"},{"ecosystem":"crates.io","fixed":["3.11.1"],"introduced":["1.1.0"],"last_affected":[],"package":"bumpalo","purl":"pkg:cargo/bumpalo","source":"GHSA-f85w-wvc7-crwc"},{"ecosystem":"crates.io","fixed":["3.11.1"],"introduced":["1.1.0"],"last_affected":[],"package":"bumpalo","purl":"pkg:cargo/bumpalo","source":"RUSTSEC-2022-0078"}],"products":null,"published":"2022-01-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A lifetime error in bumpalo's Vec::into_iter allows use-after-free, potentially leading to memory corruption or crashes when the allocator is dropped.","url":"https://insights.sbomify.com/GHSA-f85w-wvc7-crwc/"}