{"answers":{"affected":"1 open source package ship an affected version, including anyhow.","exploited":"There is no known exploitation of RUSTSEC-2026-0190 in the wild and no public exploit code.","fix":"Upgrade anyhow to 1.0.103 or later.","what":"RUSTSEC-2026-0190 is a memory corruption vulnerability in anyhow, published on 25 Jun 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0190 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0190 is a memory corruption vulnerability in anyhow, published on 25 Jun 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0190 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- anyhow (crates.io): affected from 0.0.0-0; fixed in 1.0.103\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0190/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0190/index.md)","id":"RUSTSEC-2026-0190","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0190/index.md","name":"RUSTSEC-2026-0190","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust error handling library","requires_auth":"none","summary":"Unsoundness in anyhow's downcast_mut allows undefined behavior and potential memory corruption when modifying error context.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via `Error::context` and then later calls `Error::downcast_mut` on the returned `Error`.\n\nThe flaw was corrected in commit `6e8c000` by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain.\n\n## Example\n\n```rust\nuse anyhow::Error;\nuse std::fmt;\n\n#[derive(Debug)]\nstruct ErrorContext(\u0026'static str);\n\nimpl fmt::Display for ErrorContext {\n    fn fmt(\u0026self, f: \u0026mut fmt::Formatter\u003c'_\u003e) -\u003e fmt::Result {\n        fmt::Display::fmt(\u0026self.0, f)\n    }\n}\n\nfn main() {\n    let mut error = Error::msg(\"inner error\").context(ErrorContext(\"old context\"));\n    let context: \u0026mut ErrorContext = error.downcast_mut().unwrap();\n    context.0 = \"new context\";\n    println!(\"{:?}\", error);\n}\n```\n\n## Miri output\n\n```\nerror: Undefined Behavior: trying to retag from \u003c1538\u003e for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location\n   --\u003e src/ptr.rs:170:18\n    |\n170 |         unsafe { \u0026mut *self.ptr.as_ptr() }\n    |                  ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48]\n    |\n    = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental\n    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information\nhelp: \u003c1538\u003e was created by a SharedReadOnly retag at offsets [0x38..0x48]\n   --\u003e src/ptr.rs:89:18\n    |\n 89 |             ptr: NonNull::from(ptr),\n    |                  ^^^^^^^^^^^^^^^^^^\n    = note: stack backtrace:\n            0: anyhow::ptr::Mut::\u003c'_, ErrorContext\u003e::deref_mut\n                at src/ptr.rs:170:18: 170:41\n            1: anyhow::error::\u003cimpl anyhow::Error\u003e::downcast_mut::\u003cErrorContext\u003e\n                at src/error.rs:560:18: 560:46\n            2: main\n                at examples/downcast_mut.rs:15:38: 15:58\n```","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Unsoundness in `Error::downcast_mut()`","id":"RUSTSEC-2026-0190","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["1.0.103"],"introduced":["0.0.0-0"],"last_affected":[],"package":"anyhow","purl":"pkg:cargo/anyhow","source":"RUSTSEC-2026-0190"}],"products":null,"published":"2026-06-25","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unsoundness in anyhow's downcast_mut allows undefined behavior and potential memory corruption when modifying error context.","url":"https://insights.sbomify.com/RUSTSEC-2026-0190/"}