{"answers":{"affected":"1 open source package ship an affected version, including skiplist.","exploited":"There is no known exploitation of RUSTSEC-2026-0408 in the wild and no public exploit code.","fix":"Upgrade skiplist to 1.3.0 or later.","what":"RUSTSEC-2026-0408 is a vulnerability in skiplist, published on 24 Oct 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0408 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0408 is a vulnerability in skiplist, published on 24 Oct 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0408 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- skiplist (crates.io): affected from 0.0.0-0; fixed in 1.3.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0408/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0408/index.md)","id":"RUSTSEC-2026-0408","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0408/index.md","name":"RUSTSEC-2026-0408","record":{"aliases":["GHSA-924w-mwc9-86m8"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Four code paths create a pointer whose permission is later revoked, then\nwrite through it. Miri reports each as undefined behaviour under both the\nTree Borrows and Stacked Borrows aliasing models (CWE-758). All four are\nreachable from safe code with standard `Ord` types.\n\n1. **Splice back-pointer.** `split_off`, `split_off_index` and `append` stored\n   the first spliced node's `prev` pointer from a reference to the head, then\n   wrote through that same reference, invalidating the stored pointer. A later\n   `pop_first` or `pop_front` writes through it. This affects all four\n   collections.\n2. **`SkipMap::range_mut` back pointer.** With an `Included` or `Excluded`\n   upper bound, the back pointer came from a shared reference. `next_back`\n   hands out `\u0026mut V` through it, and writing to that value is undefined\n   behaviour.\n3. **`IterMut::next_back` reads a yielded node.** In `SkipList` and `SkipMap`,\n   `next_back` read the predecessor node even after the front end had yielded\n   it as `\u0026mut`. The read freezes the caller's reference, and the caller's\n   next write through it is undefined behaviour. This affects `iter_mut`,\n   `values_mut` and `range_mut` used from both ends.\n4. **Cursor list pointer.** `lower_bound_mut` and `upper_bound_mut` on\n   `OrderedSkipList` and `SkipSet` (`cursor` feature) took the cursor's list\n   pointer, then searched through `\u0026self`. A comparator with interior-mutable\n   state, such as a `Cell` call counter, wrote to the list's memory through\n   that shared borrow and invalidated the cursor's pointer. The comparator can\n   be a fully consistent order. `SkipMap` cursors are not affected.\n\nNo miscompilation has been observed in an optimised build. A future compiler\nmay still optimise on the violated aliasing assumptions.\n\nThe flaws were corrected in 1.3.0. Each fix derives the pointer used for\nmutation from the collection's long-lived allocation pointers, and each has a\nMiri regression test.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Aliasing violations in splice, mutable iteration and cursors","id":"RUSTSEC-2026-0408","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["1.3.0"],"introduced":["0.0.0-0"],"last_affected":[],"package":"skiplist","purl":"pkg:cargo/skiplist","source":"RUSTSEC-2026-0408"}],"products":null,"published":"2026-10-24","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/RUSTSEC-2026-0408/"}