Reported

November 12, 2026

Issued

November 13, 2026

Package

ref-swap (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#use-after-free #null-pointer

References

• https://github.com/Nitrokey/ref-swap/releases/tag/v0.1.3

Patched

• >=0.1.3

Description

The variance of RefSwap and OptionRefSwap were incorrect, possibly allowing use-after-free.

OptionRefSwap::into_inner did not check for null.

The fix is to make RefSwap and OptionRefSwap invariant, and to change OptionRefSwap::into_inner to return an option. It is available in version 0.1.3. If your project still compiles with 0.1.3 then it is not affected by the unsoundness on version 0.1.2

Advisory available under CC0-1.0 license.