RUSTSEC-2026-0274 Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
A double free or use-after-free vulnerability in a Rust ring buffer library allows attackers to cause crashes or potentially execute code if element drops panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0274?
RUSTSEC-2026-0274 is an use after free vulnerability in rtrb, published on 4 Aug 2026.
Official description
ReadChunk::commit and ReadChunk::commit_all drop the committed elements
before advancing the consumer head. If an element's Drop panics during the
drop loop, head is never advanced, so the ring buffer still treats those slots
as holding live elements. When the RingBuffer is later dropped (it walks
head..tail and drops each slot), or a subsequent read_chunk() / commit()
touches the same slots, the already-dropped elements are dropped a second time —
a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.
Mitigation
Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior
change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.
Which versions are affected by RUSTSEC-2026-0274?
1 open source package ship an affected version, including rtrb.
| Package | Affected | Fixed in |
|---|---|---|
rtrb crates.io | From 0.0.0-0 | 0.3.5, 0.4.0 |
How do I fix RUSTSEC-2026-0274?
Upgrade rtrb to a fixed version for your release line: 0.3.5 or 0.4.0.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0274 being exploited?
There is no known exploitation of RUSTSEC-2026-0274 in the wild and no public exploit code.