Vulnerability CriticalRUSTSEC-2020-0023 · rulinalg
RUSTSEC-2020-0023: Lifetime boundary for `raw_slice` and `raw_slice_mut` are incorrect
Short answerA security vulnerability in the rulinalg crate: Lifetime boundary for `raw_slice` and `raw_slice_mut` are incorrect. Critical severity (CVSS 9.8). No fixed version: replace the crate or remove the affected code path.
| Crate | rulinalg |
|---|---|
| Type | Vulnerability |
| Affected versions | From 0.4.0 onward (every version). |
| Fixed in | none |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-02-11 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-35879, GHSA-q2gj-9r85-p832 |
| Affected functions | rulinalg::matrix::RowMut::raw_slice, rulinalg::matrix::RowMut::raw_slice_mut |
What to do
- Find who pulls it in:
cargo tree -i rulinalg. - Avoid the affected API (
rulinalg::matrix::RowMut::raw_slice,rulinalg::matrix::RowMut::raw_slice_mut), or replace the crate.
Details from the advisory
The affected version of rulinalg has incorrect lifetime boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut. They do not conform with Rust's borrowing rule and allows the user to create multiple mutable references to the same location. This may result in unexpected calculation result and data race if both references are used at the same time.
References
- Package: crates.io/crates/rulinalg
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0023.html
- Report: github.com/AtheMathmo/rulinalg/issues/201
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for rulinalg
Up next
Same craterulinalg: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?