GHSA-rhfx-m35p-ff5j `IterMut` violates Stacked Borrows by invalidating internal pointer
A soundness bug in the Rust HashMap iterator allows memory corruption via Stacked Borrows violations, potentially leading to crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rhfx-m35p-ff5j?
GHSA-rhfx-m35p-ff5j is a memory corruption vulnerability in lru, published on 7 Jan 2026.
Official description
Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.
Which versions are affected by GHSA-rhfx-m35p-ff5j?
3 open source packages ship an affected version, including lru.
| Package | Affected | Fixed in |
|---|---|---|
lru crates.io | From 0.9.0 | 0.16.3 |
lru crates.io | From 0.9.0 | 0.16.3 |
lru crates.io | From 0.9.0 | 0.16.3 |
How do I fix GHSA-rhfx-m35p-ff5j?
Upgrade lru to 0.16.3 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-rhfx-m35p-ff5j being exploited?
There is no known exploitation of GHSA-rhfx-m35p-ff5j in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0002.