RUSTSEC-2026-0255 Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)
A use-after-free and double-free vulnerability in the sized-chunks Rust library allows attackers to cause memory corruption or crashes via panicking Drop implementations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0255?
RUSTSEC-2026-0255 is an use after free vulnerability in sized-chunks, published on 11 Aug 2026.
Official description
Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visited again — a use-after-free / double-free reachable from safe Rust.
The RingBuffer methods require the ringbuffer feature. This is distinct from RUSTSEC-2020-0041 (Chunk::clone / insert_from, fixed in 0.6.3); the methods here are still affected in 0.7.0. The repository is archived with issues/PRs disabled and no fix available.
Impact
- CWE-415 (Double Free): the same allocation is freed twice.
- CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated
Drop.
Reachable entirely from safe Rust via catch_unwind with element types whose Drop can panic.
Which versions are affected by RUSTSEC-2026-0255?
1 open source package ship an affected version, including sized-chunks.
| Package | Affected | Fixed in |
|---|---|---|
sized-chunks crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0255?
No fix has been published for RUSTSEC-2026-0255 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0255 being exploited?
There is no known exploitation of RUSTSEC-2026-0255 in the wild and no public exploit code.