rustsec-2026-0291
osv_rustsec`OwnedAlloc::drop_in_place` destroys the contained value by hand, then commits the ownership transfer with `mem::forget(self)` — which lives inside `into_raw` and so runs only after the destruction. `T::drop` is user code and may panic. If it does, the forget is skipped and the still-live `OwnedAlloc` unwinds, whose destructor drops the same `T` a second time and then deallocates. For a `T` that owns an allocation, the same block is freed twice — a double free (CWE-415). That destructor also reads the already-destroyed value through `Layout::for_value` before deallocating, a use-after-free (CWE-416). `MaybeUninitAlloc::drop_in_place` delegates to the same function, so both public entry points are affected. Storing a value whose `Drop` can panic and calling either is enough — no `unsafe` on the caller's side. ## Fix No fixed release is available. The crate has had no release since 2018 and the maintainer has not responded to the report, nor to the one on `lockfree`, which is published from the same account. `forget_inner` leaks the value instead of destroying it, which is safe.
- Published
- unknown
- Last Modified
- unknown
CVSS details not available.
No product information available.
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"categories": [
"memory-corruption"
],
"cvss": null,
"informational": null,
"source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0291.json"
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"owned_alloc::MaybeUninitAlloc::drop_in_place",
"owned_alloc::OwnedAlloc::drop_in_place"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "owned-alloc",
"purl": "pkg:cargo/owned-alloc"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
}
],
"type": "SEMVER"
}
]
}
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "`OwnedAlloc::drop_in_place` destroys the contained value by hand, then commits\nthe ownership transfer with `mem::forget(self)` — which lives inside `into_raw`\nand so runs only after the destruction. `T::drop` is user code and may panic. If\nit does, the forget is skipped and the still-live `OwnedAlloc` unwinds, whose\ndestructor drops the same `T` a second time and then deallocates. For a `T` that\nowns an allocation, the same block is freed twice — a double free (CWE-415).\nThat destructor also reads the already-destroyed value through\n`Layout::for_value` before deallocating, a use-after-free (CWE-416).\n\n`MaybeUninitAlloc::drop_in_place` delegates to the same function, so both public\nentry points are affected. Storing a value whose `Drop` can panic and calling\neither is enough — no `unsafe` on the caller's side.\n\n## Fix\n\nNo fixed release is available. The crate has had no release since 2018 and the\nmaintainer has not responded to the report, nor to the one on `lockfree`, which\nis published from the same account. `forget_inner` leaks the value instead of\ndestroying it, which is safe.",
"id": "RUSTSEC-2026-0291",
"modified": "2026-09-21T09:15:02.893165285Z",
"published": "2026-09-09T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/owned-alloc"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0291.html"
},
{
"type": "REPORT",
"url": "https://gitlab.com/bzim/owned-alloc/-/issues/1"
}
],
"schema_version": "1.9.0",
"summary": "Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics"
}