RUSTSEC-2026-0300 Use-after-free in `clear` and `retain` when an element's `Drop` panics
A use-after-free and double-free vulnerability in the Rust SkipList library allows attackers to execute arbitrary code or cause denial of service if element Drop panics.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0300?
RUSTSEC-2026-0300 is an use after free vulnerability in skiplist, published on 2 Sep 2026.
Official description
SkipList::clear drops the node chain and only then resets tail and len.
The drop runs each element's Drop, and T carries no bounds excluding a
panicking one. If it unwinds, tail still points at the freed node while len
stays non-zero.
back(), back_mut(), last_key_value() and last() dereference tail
through unsafe, so reading the container after the unwind is a use-after-free
(CWE-416). Drop for SkipList calls Box::from_raw on self.head, which
clear already destroyed, so dropping the container is a double free
(CWE-415).
retain, retain_mut and dedup_by reach the same state through
Node::filter_rebuild, which frees nodes and runs a user predicate before the
caller commits tail and len. There the head links are left partially
rewired, so traversal can also reach freed nodes.
Mitigation
Update to 1.1.1.
Which versions are affected by RUSTSEC-2026-0300?
1 open source package ship an affected version, including skiplist.
| Package | Affected | Fixed in |
|---|---|---|
skiplist crates.io | From 0.0.0-0 | 1.1.1 |
How do I fix RUSTSEC-2026-0300?
Upgrade skiplist to 1.1.1 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0300 being exploited?
There is no known exploitation of RUSTSEC-2026-0300 in the wild and no public exploit code.
Sources
Also known as GHSA-x6j6-3ffp-qrfr.