PT-2026-31670 · Crates.Io · Intaglio
Published
2026-03-30
·
Updated
2026-03-30
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Affected versions of this crate can leave all
SymbolTable variants in an
internally inconsistent state if a custom BuildHasher panics during
HashMap::insert and the caller recovers with catch unwind.The
intern implementations committed a vec.push(...) before the matching
map.insert(...) completed. If hashing panicked in that window, later lookups
and inserts could observe diverging vec and map lengths.In release builds, this can lead to symbol confusion where a newly interned
string resolves to previously interned attacker-controlled contents. In debug
builds, the same corruption is detected by follow-up assertions and results in
panics.
The flaw was corrected in version 1.13.3 by making the
vec mutation
transactional across unwind boundaries so partially inserted entries are rolled
back before the panic propagates. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Intaglio