Loading...
Skip to main content

GHSA-7mcq-f592-pf7v — Vulnerability in slice-ring-buffer —...

HIGH

Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs

Published July 16, 2025Updated October 28, 2025Source: osv

Summary

The crate [`slice-ring-buffer`](https://crates.io/crates/slice-ring-buffer) was developed as a fork of [`slice-deque`](https://crates.io/crates/slice-deque) to continue maintenance and provide security patches, since the latter has been officially unmaintained ([RUSTSEC-2020-0158](https://rustsec.org/advisories/RUSTSEC-2020-0158.html)). While `slice-ring-buffer` has addressed some previously reported memory safety issues inherited from its fork origin ([RUSTSEC-2021-0047](https://rustsec.org/advisories/RUSTSEC-2021-0047.html)), it still retains multiple unresolved memory corruption vulnerabilities. Specifically, we have discovered four new memory safety bugs, each resulting in double-free violations that can occur when only safe APIs are invoked. These vulnerabilities correspond to four distinct safe APIs in the crate, each exposing unsound and vulnerable behavior due to incorrect usage of unsafe code internally. Unfortunately, the maintainer doesn't have much availability to resolve these issues so there's no concrete timeline for fixes. Community contributions towards fixing these vulnerabilities would be much appreciated.

Advisory Timeline

  • First published July 16, 2025 (453 days ago).
  • Last revised October 28, 2025 — 104 days after initial publication.

Affected Packages (2)

Affects 1 ecosystem: crates.io (2).

PackageEcosystemAffectedFixed In
slice-ring-buffer
crates.io
All versionsRange-based data available
slice-deque
crates.io
All versionsRange-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Frequently Asked Questions

What is GHSA-7mcq-f592-pf7v?
Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
How do I check if my project is affected by GHSA-7mcq-f592-pf7v?
GHSA-7mcq-f592-pf7v affects slice-ring-buffer and slice-deque. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-7mcq-f592-pf7v and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

RUSTSEC-2025-0044

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies