{"answers":{"affected":"1 open source package ship an affected version, including lru.","exploited":"There is no known exploitation of RUSTSEC-2026-0253 in the wild and no public exploit code.","fix":"Upgrade lru to 0.18.2 or later.","what":"RUSTSEC-2026-0253 is an use after free vulnerability in lru, published on 12 May 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0253 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0253 is an use after free vulnerability in lru, published on 12 May 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0253 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- lru (crates.io): affected from 0.0.0-0; fixed in 0.18.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0253/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0253/index.md)","id":"RUSTSEC-2026-0253","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0253/index.md","name":"RUSTSEC-2026-0253","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":true,"product_category":"Rust LRU cache library","requires_auth":"none","summary":"A use-after-free vulnerability in the lru crate allows memory corruption if a key's Drop implementation panics during pop operations.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"`LruCache::pop()` in `lru` was not panic-safe. If the `Drop` implementation of a stored key panics during `pop()`, `self.detach()` is never called, leaving dangling pointers in the internal doubly-linked list.\n\nA subsequent cache operation that triggers eviction can then dereference these dangling pointers:\n- The node is freed from the map, but remains linked in the LRU list due to the skipped `detach()` call\n- When a new insertion causes eviction, the LRU traversal encounters the dangling pointer\n- This results in a write to already-freed memory during the eviction process\n\n## Impact\n\n- **CWE-416 (Use-After-Free):** memory corruption when subsequent cache operations access freed node pointers in the linked list\n- **CWE-415 (Double Free):** potential heap corruption when the same memory is freed multiple times\n\nBoth types of undefined behavior can be invoked in safe Rust, but only if unwinding panics are enabled and `std::panic::catch_unwind` is used with key types that have potentially-panicking `Drop` implementations.\n\n## Fix\n\nFixed in `lru` 0.18.2 by detaching the node from the linked list before freeing it and dropping the key ([lru-rs#238](https://github.com/jeromefroe/lru-rs/pull/238)).","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","id":"RUSTSEC-2026-0253","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.18.2"],"introduced":["0.0.0-0"],"last_affected":[],"package":"lru","purl":"pkg:cargo/lru","source":"RUSTSEC-2026-0253"}],"products":null,"published":"2026-05-12","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A use-after-free vulnerability in the lru crate allows memory corruption if a key's Drop implementation panics during pop operations.","url":"https://insights.sbomify.com/RUSTSEC-2026-0253/"}