GHSA-xqjr-wfx3-gmxv ArrayQueue's push_front is not panic-safe
A panic during cloning in ArrayQueue's push_front causes the destructor to free uninitialized memory, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xqjr-wfx3-gmxv?
GHSA-xqjr-wfx3-gmxv is a memory corruption vulnerability in array-queue, published on 14 Aug 2025.
Official description
The safe API array_queue::ArrayQueue::push_front can lead to deallocating uninitialized memory if a panic occurs while invoking the clone method on the passed argument.
Specifically, push_front receives an argument that is intended to be cloned and pushed, whose type implements the Clone trait. Furthermore, the method updates the queue's start index before initializing the slot for the newly pushed element. User-defined implementations of Clone may include a clone method that can panic. If such a panic occurs during initialization, the structure is left with an advanced start index pointing to an uninitialized slot. When ArrayQueue is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.
The bug was fixed in commit 728fe1b.
Which versions are affected by GHSA-xqjr-wfx3-gmxv?
3 open source packages ship an affected version, including array-queue.
| Package | Affected | Fixed in |
|---|---|---|
array-queue crates.io | From 0.3.0 | 0.4.0 |
array-queue crates.io | From 0.3.0 | 0.4.0 |
array-queue crates.io | From 0.3.0 | 0.4.0 |
How do I fix GHSA-xqjr-wfx3-gmxv?
Upgrade array-queue to 0.4.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-xqjr-wfx3-gmxv being exploited?
There is no known exploitation of GHSA-xqjr-wfx3-gmxv in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0054.