PT-2026-6477 · Crates.Io · Lru

Published 2026-01-07 · Updated 2026-01-07

OSV

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.

This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

GHSA-RHFX-M35P-FF5J

Affected Products

Lru

References · 4

• https://osv.dev/vulnerability/GHSA-rhfx-m35p-ff5j · Vendor Advisory
• https://github.com/jeromefroe/lru-rs/pull/224 · Note
• https://github.com/jeromefroe/lru-rs · Note
• https://rustsec.org/advisories/RUSTSEC-2026-0002.html · Note