Description
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | thin-vec | — | 0.2.16 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-thin-vec | 0.2.17-1 | — |
| Debian 13 | rust-thin-vec | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-thin-vec | No fix yet | — |
| Ubuntu 26.04 LTS | rust-thin-vec | No fix yet | — |
| Ubuntu 25.10 | rust-thin-vec | No fix yet | — |
| Ubuntu 24.04 LTS | rust-thin-vec | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.10.1-1.amzn2023.0.1 | ALAS2023-2026-1652 |
| Amazon Linux 2023 | rust +14 | 1.95.0-1.amzn2023.0.2 | ALAS2023-2026-1676 |
| Amazon Linux 2 | rust +11 | 1.95.0-1.amzn2.0.2 | ALAS2-2026-3296 |
| Amazon Linux 2 | thunderbird | 140.10.0-1.amzn2.0.1 | ALAS2-2026-3290 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruff +1 | 0.15.10-r0 | — |
| Wolfi rolling | rust-analyzer | 20260413-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | thin-vec | < 0.2.16 | 0.2.16 | GHSA-xphw-cqx3-667j |
| crates.io | thin-vec | >= 0.0.0-0, < 0.2.16 | 0.2.16 | RUSTSEC-2026-0103 |
Advisories 4
- ALAS2-2026-3290 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2-2026-3296 Important: rust security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2023-2026-1652 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2023-2026-1676 Important: rust security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026