Reported

August 4, 2026

Issued

September 1, 2026

Package

rtrb (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#memory-safety #double-free #use-after-free #panic-safety

References

• https://github.com/mgeier/rtrb/issues/185

Patched

• ^0.3.5
• >=0.4.0

Affected Functions

Version

rtrb::chunks::ReadChunk::commit

• <0.3.5

rtrb::chunks::ReadChunk::commit_all

• <0.3.5

Description

ReadChunk::commit and ReadChunk::commit_all drop the committed elements before advancing the consumer head. If an element's Drop panics during the drop loop, head is never advanced, so the ring buffer still treats those slots as holding live elements. When the RingBuffer is later dropped (it walks head..tail and drops each slot), or a subsequent read_chunk() / commit() touches the same slots, the already-dropped elements are dropped a second time — a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

Mitigation

Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.

Advisory available under CC0-1.0 license.