# RUSTSEC-2026-0408: Aliasing violations in splice, mutable iteration and cursors


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 24 Oct 2026
- **Also known as:** GHSA-924w-mwc9-86m8

## What is RUSTSEC-2026-0408?

RUSTSEC-2026-0408 is a vulnerability in skiplist, published on 24 Oct 2026. 

### Official description

Four code paths create a pointer whose permission is later revoked, then
write through it. Miri reports each as undefined behaviour under both the
Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are
reachable from safe code with standard `Ord` types.

1. **Splice back-pointer.** `split_off`, `split_off_index` and `append` stored
   the first spliced node's `prev` pointer from a reference to the head, then
   wrote through that same reference, invalidating the stored pointer. A later
   `pop_first` or `pop_front` writes through it. This affects all four
   collections.
2. **`SkipMap::range_mut` back pointer.** With an `Included` or `Excluded`
   upper bound, the back pointer came from a shared reference. `next_back`
   hands out `&mut V` through it, and writing to that value is undefined
   behaviour.
3. **`IterMut::next_back` reads a yielded node.** In `SkipList` and `SkipMap`,
   `next_back` read the predecessor node even after the front end had yielded
   it as `&mut`. The read freezes the caller's reference, and the caller's
   next write through it is undefined behaviour. This affects `iter_mut`,
   `values_mut` and `range_mut` used from both ends.
4. **Cursor list pointer.** `lower_bound_mut` and `upper_bound_mut` on
   `OrderedSkipList` and `SkipSet` (`cursor` feature) took the cursor's list
   pointer, then searched through `&self`. A comparator with interior-mutable
   state, such as a `Cell` call counter, wrote to the list's memory through
   that shared borrow and invalidated the cursor's pointer. The comparator can
   be a fully consistent order. `SkipMap` cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler
may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for
mutation from the collection's long-lived allocation pointers, and each has a
Miri regression test.

## Which versions are affected by RUSTSEC-2026-0408?

1 open source package ship an affected version, including skiplist.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `skiplist` | crates.io | From 0.0.0-0 | 1.3.0 |

## How do I fix RUSTSEC-2026-0408?

Upgrade skiplist to 1.3.0 or later.

## Is RUSTSEC-2026-0408 being exploited?

There is no known exploitation of RUSTSEC-2026-0408 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for RUSTSEC-2026-0408 and fix it if it is affected.

What it is: RUSTSEC-2026-0408 is a vulnerability in skiplist, published on 24 Oct 2026. 
Exploitation: There is no known exploitation of RUSTSEC-2026-0408 in the wild and no public exploit code.

Affected packages and fixed versions:
- skiplist (crates.io): affected from 0.0.0-0; fixed in 1.3.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/RUSTSEC-2026-0408/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0408/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/RUSTSEC-2026-0408

---
From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2026-0408/
Summaries are generated and may contain mistakes; the official description above is the record.