RUSTSEC-2026-0309 `SinglyLinkedList::remove` dereferences a null link
A null pointer dereference in SinglyLinkedList::remove causes undefined behavior and potential crashes when removing nodes from empty or invalid lists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0309?
RUSTSEC-2026-0309 is a vulnerability in bun_collections, published on 20 Sep 2026.
Official description
In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, (*current_elm).next reads a null pointer. That is undefined behavior. The list head is a raw *mut Node<T>, and safe code can construct the empty list.
The maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional assert! before the pointer is followed, matching the upstream Zig unwrap on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.
Which versions are affected by RUSTSEC-2026-0309?
1 open source package ship an affected version, including bun_collections.
| Package | Affected | Fixed in |
|---|---|---|
bun_collections crates.io | From 0.0.0-0 | 0.2.1 |
How do I fix RUSTSEC-2026-0309?
Upgrade bun_collections to 0.2.1 or later.
Is RUSTSEC-2026-0309 being exploited?
There is no known exploitation of RUSTSEC-2026-0309 in the wild and no public exploit code.