GHSA-jh37-772x-4hpwHighCVSS 7.5

Double free in algorithmica

Published
August 25, 2021
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2021-31996 →

📋 Description

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, merge_sort::merge() wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking merge_sort::merge() on Vec<T: Drop> can cause double free bugs.

🎯 Affected products1

  • rust/algorithmica:<= 0.1.8

🔗 References (4)