parse_arguments reads a caller-supplied pointer as a slice

SinglyLinkedList::remove dereferences a null link

Use-after-free in interned values and cached function results

hex_decode_unchecked AVX2 path reads past src

Use-after-free when XML includes have duplicated entities

Use-after-free when a future's Drop panics while the container is dropped

Use-after-free in clear and retain when an element's Drop panics

stack-graphs C API exports are safe extern "C" functions

Double free in StackVec::retain when a predicate or element Drop panics

Memory corruption bug on ApplyResult type

Double free / use-after-free in Chunk and InlineArray removal methods when an element's Drop panics

Double free / use-after-free in Consumer::skip and Consumer::clear when an element's Drop panics

Double free in OwnedAlloc::drop_in_place when the contained value's Drop panics

Double free in Map::into_iter and an uninitialized Arc in SharedIncin::clear

Double free in AlignedBox<[T]>::realloc_with_default when an element's Drop panics

Double free / use-after-free in ReadChunk::commit when an element's Drop panics

soundness issue

Panic-safety unsoundness in Stack::pop, Fifo::pop_front and Value::replace_stable (use-after-free / double-free)

Panic-safety unsoundness in BitVecCore::clear (double-free / use-after-free)

Panic-safety unsoundness in Chunk and InlineArray (use-after-free / double-free)

Panic-safety unsoundness in truncate_back, truncate_front, clear, and extend_from_slice (use-after-free / double-free)

Panic-safety unsoundness in Chunk, RingBuffer, and InlineArray (use-after-free / double-free)

hugepage_rs::dealloc may allow invalid memory deallocation from safe code

Potential use-after-free due to lack of panic safety in LruCache::pop()

Panic-safety unsoundness in SplitVec::extend_from_slice (uninitialized read)

Bitmap::try_from(&[u8]) can create invalid values

Aliasing violation in OrdSet insertion

setlocale and TextDomain::init are unsound as they access environment with no synchronization

Safe ErrorRegistry APIs can cause undefined behavior

Crafted archives can cause a use-after-free during deserialization

event-listener allows !Send tags to cross thread boundaries via StackSlot

Enum trait allows type confusion when manually implemented

Report::frames_mut allows aliased mutable references

Matrix{2,3,4}::swap_columns can trigger undefined behavior for identical indices

EbpfVm::invoke_function performs out-of-bounds pointer arithmetic

Unsoundness in Error::downcast_mut()

Several memory corruption issues via safe APIs

Bad-free in MetaCallException::new

Use-after-free

Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

VMABuffer::set_data may allow out-of-bounds writes from safe code

Double-free in vmem storage reachable from safe Rust (predecessor of oneringbuf)

Double-free in vmem storage reachable from safe Rust

Out-of-bounds read/write in Index and IndexMut implementations

Double-free and use-after-free in Keys::next()

Double-free in Chomp::inner()

Invalid pointer arithmetic in iter() and iter_mut()

Integer overflow in array::ReadWrite::new() leading to potential memory corruption

Null-pointer dereference and double-free via safe APIs

Buffer overflow in Clusterings::from_i32_column_major_order()

Out-of-bounds read in bytes_helper public safe functions

Potential use-after-free due to lack of panic safety in InlineVec::clear and SerVec::clear

Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

RustSec Advisory

hexchat crate is unsound and unmaintained

Type confusion when accessing data from sublasses of subclasses of native types with abi3 feature targeting Python 3.12 and up

Potential undefined behavior when dereferencing Buf struct

Integer overflow in BytesMut::reserve

Unsound APIs of public constant::Reader and StructSchema

Segmentation fault and invalid memory read in mnl::cb_run

IterMut violates Stacked Borrows by invalidating internal pointer

Potential Undefined Behaviors in Arc<T>/Rc<T> impls of from_value on OOM

Non-utf8 String can be created with TimeBuf::as_str

Unsoundness of safe reciprocal_mg10

Reader::open_mmap unsoundly marks unsafe memmap operation as safe

Lack of sufficient checks in public API

Heap-buffer-overflow in nftnl::Batch::with_page_size (nftnl-rs)

soundness issue and unmaintained

Out-of-bounds memory access in binary_read_to_ref and binary_write_from_ref

Undefined behavior in index_of_ptr with empty slices

soundness issue and unmaintained

Possible unsound public API

soundness issue and unmaintained

Heap Buffer Overflow in the DrainCol Destructor

ArrayQueue::push_front is not panic-safe

Multiple memory corruption vulnerabilities in safe APIs

IdMap::from_iter may lead to uninitialized memory being freed on drop

User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows

ConstStaticCell could have been used to pass non-Send values to another thread

Four unique double-free vulnerabilities triggered via safe APIs

Uninitialized read after allocating MemBump

Lack of sufficient checks in public API

Multiple soundness issues in macroquad

soundness issue and unmaintained

Public API without sufficient bounds checking

Safe API can cause heap-buffer-overflow

Unsound public API in unmaintained crate

cve-rs introduces memory vulnerabilities in safe Rust

totally-safe introduces memory vulnerabilities in safe Rust

totally-safe-transmute allows transmuting any type to any other type in safe Rust

Guest-controlled out-of-bounds read/write on x86_64

Undefined Behavior in Rust runtime functions

Use after free with externrefs and epoch interruption in Wasmtime

Use After Free with externrefs in Wasmtime

Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator

crossbeam-channel: double free on Drop

Broadcast channel calls clone in parallel, but does not require Sync

Use-After-Free in Md::fetch and Cipher::fetch

array-init-cursor in version 0.2.0 and below is unsound when used with types that implement Drop

Use after free in Parc and Prc due to missing lifetime constraints

Openh264 Decoding Functions Heap Overflow Vulnerability

Out of bounds write triggered by crafted coverage data

Build corruption when using PYO3_CONFIG_FILE environment variable

Risk of use-after-free in borrowed reads from Python weak references

Heap Buffer overflow using c_chars_to_str function

Segmentation fault due to use of uninitialized memory

Incorrect usage of #[repr(packed)]

Incorrect usage of #[repr(packed)]

Parts of Report are dropped as the wrong type during downcast

Stack buffer overflow with whoami on several Unix platforms

ObjectPool creates uninitialized memory when freeing objects

Non-idiomatic use of iterators leads to use after free

dav1d AV1 decoder integer overflow

Buffer overflow due to integer overflow in transpose

Memory corruption, denial of service, and arbitrary code execution in libgit2

Potential stack use-after-free in Instrumented::into_inner

serde deserialization for FamStructWrapper lacks bound checks that could potentially lead to out-of-bounds memory access

openssl X509StoreRef::objects is unsound

libwebp: OOB write in BuildHuffmanTable

libwebp: OOB write in BuildHuffmanTable

Use-after-free in vec_insert_bytes

memoffset allows reading uninitialized memory

Parsing borsh messages with ZST which are not-copy/clone is unsound

Unsound FFI: Wrong API usage causes write past allocated area

rmp-serde Raw and RawRef unsound

NULL pointer dereference in stb_image

out_reference::Out::from_raw should be unsafe

maligned::align_first causes incorrect deallocation

Ascii allows out-of-bounds array indexing in safe code

pnet_packet buffer overrun in set_payload setters

ELF header parsing library doesn't check for valid offset

Use-after-free due to a lifetime error in Vec::into_iter()

Bug in Wasmtime implementation of pooling instance allocator

Unsound API in secp256k1 allows use-after-free and invalid deallocation from safe code

Multiple vulnerabilities resulting in out-of-bounds writes

mozjpeg DecompressScanlines::read_scanlines is Unsound

cell-project used incorrect variance when projecting through &Cell<T>

os_socketaddr invalidly assumes the memory layout of std::net::SocketAddr

Memory corruption in liblz4

Out-of-bounds read when opening multiple column families with TTL

Unsoundness of AtomicCell<64> arithmetics on 32-bit targets that support Atomic64

Multiple soundness issues in owning_ref

Safety issues in pkcs11

MsQueue push/pop use the wrong orderings

Use after free in Neon external buffers

array! macro is unsound when its length is impure constant

Use after free with externrefs and epoch interruption in Wasmtime

Arrow2 allows double free in safe code

enum_map macro can cause UB when Enum trait is incorrectly implemented

Delegate functions are missing Send bound

Data race in Iter and IterMut

array! macro is unsound in presence of traits that implement methods it calls internally

Unsoundness in dashmap references

Integer overflow in the bundled Brotli C library

Use after free in lru crate

Integer overflow in the bundled Brotli C library

Incorrect Lifetime Bounds on Closures in rusqlite

Data race when sending and receiving after closing a oneshot channel

Potential segfault in localtime_r invocations

Out-of-bounds write in nix::unistd::getgrouplist

AtomicBucket unconditionally implements Send/Sync

Memory Safety Issue when using patch or merge on state and assign the result back to state

Multiple Vulnerabilities in Wasmtime

Improper Synchronization and Race Condition in vm-memory

vec-const attempts to construct a Vec from a pointer to a const slice

Data race in crossbeam-deque

Optional Deserialize implementations lacking validation

mopa is technically unsound

QueryInterface should call AddRef before returning pointer

Task dropped in wrong thread when aborting LocalSet task

Double free in Vec::from_iter specialization when drop panics

VecStorage Deserialize Allows Violation of Length Invariant

Memory access due to code generation flaw in Cranelift module

'merge_sort::merge()' crashes with double-free for T: Drop

Zip can cause buffer overflow when a consumed Zip iterator is used again

String::retain allows safely creating invalid strings when abusing panic

Logic bug in Read can cause buffer overflow in read_to_end()

Panic safety violation in BinaryHeap

Zip may call __iterator_get_unchecked twice with the same index

VecDeque::make_contiguous may duplicate the contained elements

Panic safety issue in Zip specialization

TrustedRandomAccess specialization composes incorrectly for nested iter::Zips

Multiple functions can cause double-frees

RingBuffer can create multiple mutable references and cause data races

SliceDeque::drain_filter can double drop an element if the predicate panics

Data race and memory safety issue in Index

StackVec::extend can write out of bounds when size_hint is incorrect

Generators can cause data races if non-Send types are used in their generator functions

through and through_and causes a double free if the map function panics

ImmediateIO and TransactionalIO can cause data races

FromIterator implementation for Vector/Matrix can drop uninitialized memory

Multiple soundness issues in Ptr

Use after free possible in uri::Formatter on panic

insert_many can drop elements twice on panic

panic in user-provided Endian impl triggers double drop of T

panic safety: double drop or uninitialized drop of T upon panic

Fix a use-after-free bug in diesels Sqlite backend

push_cloned can drop uninitialized memory or double free on panic

split_at allows obtaining multiple mutable references to the same data

move_elements can double-free objects on panic

Deserializing an array can drop uninitialized memory on panic

arr! macro erases lifetimes

Loading a bgzip block can write out of bounds if size overflows.

Multiple memory safety issues in insert_row

Use-after-free when cloning a partially consumed Vec iterator

Use-after-free in subscript_next and subscript_prev wrappers

insert_slice_clone can double drop if Clone panics.

Multiple soundness issues

Queues allow non-Send types to be sent to other threads, allowing data races

Send bound needed on T (for Send impl of Bucket2)

MvccRwLock allows data races & aliasing violations

Bunch unconditionally implements Send/Sync

Sectors::get accesses unclaimed/uninitialized memory

FixedCapacityDequeLike::clone() can cause dropping uninitialized memory

Queue should have a Send bound on its Send/Sync traits

convec::ConVec unconditionally implements Send/Sync

dces' World type can cause data races

LockWeak<T> allows to create data race to T.

AtomicBox lacks bound on its Send and Sync traits allowing data races

Slock allows sending non-Send types across thread boundaries

ShmWriter allows sending non-Send type across threads

ArcGuard's Send and Sync should have bounds on RC

SyncRef's clone() and debug() allow data races

SyncChannel can move 'T: !Send' to other threads

CopyCell lacks bounds on its Send trait allowing for data races

Send/Sync bound needed on T for Send/Sync impl of RcuCell

Cache: Send/Sync impls needs trait bounds on K

ReaderResult should be bounded by Sync

beef::Cow lacks a Sync bound on its Send trait allowing for data races

ReadTicket and WriteTicket should only be sendable when T is Send

AtomicBox implements Send/Sync for any T: Sized

Decoder<R> can carry R: !Send to other threads

Future lacks bounds on Send and Sync.

QueueSender/QueueReceiver: Send/Sync impls need T: Send

PinSlab and Unordered<T, S> need bounds on their Send/Sync traits

Soundness issues in raw-cpuid

Singleton lacks bounds on Send and Sync.

Demuxer can carry non-Send types across thread boundaries

hashconsing's HConsed lacks Send/Sync bound for its Send/Sync trait.

may_queue's Queue lacks Send/Sync bound for its Send/Sync trait.

Update unsound DrainFilter and RString::retain

ButtplugFutureStateShared allows data race to (!Send|!Sync) objects

Soundness issue: Input can be misused to create data race to an object

Queues allow non-Send types to be sent to other threads, allowing data races

AtomicOption should have Send + Sync bound on its type argument.

panic safety: double drop may happen within util::{mutate, mutate2}

panic safety issue in impl TransformContent<S, D> for [S; (2|3|4)]

LateStatic has incorrect Sync bound

conquer-once's OnceCell lacks Send bound for its Sync trait.

ImageChunkMut needs bounds on its Send and Sync traits

EventList's From conversions can double drop on panic.

impl Random on arrays can lead to dropping uninitialized memory

Double free when calling sys_info::disk_info from multiple threads

Aovec lacks bound on its Send and Sync traits allowing data races

Exposes internally used raw pointer

Missing Send bound for Lazy

Soundness issue with base::Error

UsbContext trait did not require implementers to be Send and Sync.

Double drop upon panic in 'fn map_array()'

Buffer overflow in SmallVec::insert_many

Unsound: can make ARefss contain a !Send, !Sync object.

Dangling reference in access::Map with Constant

Thex allows data races of non-Send types across threads

Some lock_api lock guard objects can cause data races

Potential segfault in the time crate

GenericMutexGuard allows data races of non-Sync types across threads

Improper Sync implementation on FuturesUnordered in futures-utils can cause data corruption

futures_task::waker may cause a use-after-free if used on a type that isn't 'static

Use-after-free with objects returned by Stream's get_format_info and get_context methods

Fix for UB in failure to catch panics crossing FFI boundaries

Possible use-after-free with proplist::Iterator

Undefined Behavior in bounded channel

CBox API allows to de-reference raw pointers without unsafe code

HeaderMap::Drain API is unsound

Stream callback function is not unwind safe

Parsing a specially crafted message can result in a stack overflow

Multiple security issues including data race, buffer overflow, and uninitialized memory drop

sigstack allocation bug can cause memory corruption or leak

Flaw in generativity allows out-of-bounds access

use-after or double free of allocated memory

rio allows a use-after-free buffer access when a future is leaked

bespoke Cell implementation allows obtaining several mutable references to the same data

Enum repr causing potential memory corruption

Use-after-free in BodyStream due to lack of pinning

Use after free in ArcIntern::drop

Multiple memory safety issues

Use-after-free in Framed due to lack of pinning

Memory corruption in SmallVec::grow()

Matrix::zip_elements causes double free

bespoke Cell implementation allows obtaining several mutable references to the same data

Compiler optimisation for next_with_timeout in pnet::transport::IcmpTransportChannelIterator flaws to SEGFAULT

traitobject assumes the layout of fat pointers

Buffer overflow vulnerability in str::repeat()

Memory safety vulnerabilities arising from Error::type_id