Rust advisories / linked-hash-map
Unsound CriticalRUSTSEC-2020-0026 · linked-hash-map
RUSTSEC-2020-0026: linked-hash-map creates uninitialized NonNull pointer
Short answerlinked-hash-map has an API that can cause undefined behaviour from safe code: linked-hash-map creates uninitialized NonNull pointer. Fixed in 0.5.3.
| Crate | linked-hash-map |
|---|---|
| Type | Unsound |
| Affected versions | Before 0.5.3. |
| Fixed in | 0.5.3 |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-06-23 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-25573, GHSA-r43h-gmrm-h5c9 |
What to do
- See which version you have:
cargo tree -i linked-hash-map(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p linked-hash-map. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplelinked-hash-map = "0.5.3") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions of this crate called mem::uninitialized() to create a NonNull<T>, which is undefined behavior.
The flaw was corrected by avoiding the use of mem::uninitialized().
References
- Package: crates.io/crates/linked-hash-map
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0026.html
- Web: github.com/contain-rs/linked-hash-map/pull/100
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same cratelinked-hash-map: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?