GHSA-7mcq-f592-pf7v — Vulnerability in slice-ring-buffer —...
Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs
Summary
Advisory Timeline
- First published July 16, 2025 (453 days ago).
- Last revised October 28, 2025 — 104 days after initial publication.
Affected Packages (2)
Affects 1 ecosystem: crates.io (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| slice-ring-buffer | crates.io | All versions | Range-based data available |
| slice-deque | crates.io | All versions | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-415
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
References
Frequently Asked Questions
- What is GHSA-7mcq-f592-pf7v?
- Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
- How do I check if my project is affected by GHSA-7mcq-f592-pf7v?
- GHSA-7mcq-f592-pf7v affects slice-ring-buffer and slice-deque. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-7mcq-f592-pf7v and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2018-20995CRITICAL
Bug in SliceDeque::move_head_unchecked allows read of corrupted memory
- CVE-2019-15543CRITICAL
Bug in SliceDeque::move_head_unchecked corrupts its memory
- CVE-2019-15543CRITICAL
Out of bounds write in slice-deque
- CVE-2018-20995CRITICAL
Memory corruption slice-deque
- CVE-2026-93657HIGH
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
- CVE-2026-18140HIGH
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies