sp-sized-chunks

Activity

Latest release: 4y ago
Total releases: 1
Cadence: —
Last 12 months: 0

Details

License: MIT
First release: Oct 04, 2021

Releases

Version	Released
`0.1.0` unknown 2 CVEs	Oct 04, 2021

Dependencies (4)

Depends on

0.1.0

Used by

Supply-chain exposure

2 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

1 of 4

bitmaps 2 CVEs

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (2)

RUSTSEC-2026-0270 Aug 11, 2026

`sp-sized-chunks` is unmaintained

The sp-sized-chunks crate is a fork of sized-chunks. Its repository is archived and the crate is no longer maintained. Users should migrate to imbl-sized-chunks, a maintained fork.

References

https://crates.io/crates/sp-sized-chunks
https://rustsec.org/advisories/RUSTSEC-2026-0270.html

Updated Aug 31, 2026 · Source: OSV.dev
RUSTSEC-2026-0254 Aug 11, 2026

Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)

Several methods in sp-sized-chunks drop elements before updating the container's length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container is later dropped, its own Drop re-visits those slots and drops the freed elements again — a use-after-free / double-free reachable from safe Rust.

sp-sized-chunks is a fork of sized-chunks (companion advisory filed separately) and carries the same bug. The repository is archived and the crate is still on 0.1.0 with no fix available.

Impact

CWE-415 (Double Free): the same allocation is freed twice (e.g. an element holding Box<T>).

CWE-416 (Use-After-Free): an element reads its own freed allocation during Drop (e.g. String) — confirmed under AddressSanitizer.

All are reachable from safe Rust via catch_unwind with element types whose Drop can panic.

References

https://crates.io/crates/sp-sized-chunks
https://rustsec.org/advisories/RUSTSEC-2026-0254.html

Updated Aug 12, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

unknown 1

1 releases

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More