Reported

January 7, 2026

Issued

January 7, 2026 (last modified: January 8, 2026)

Package

lru (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#stacked-borrows

Aliases

• GHSA-rhfx-m35p-ff5j

References

• https://github.com/jeromefroe/lru-rs/pull/224

Patched

• >=0.16.3

Unaffected

• <0.9.0

Description

Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.

This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.

Advisory available under CC0-1.0 license.