Rust advisories / alg_ds
Vulnerability CriticalRUSTSEC-2020-0033 · alg_ds
RUSTSEC-2020-0033: Matrix::new() drops uninitialized memory
Short answerA security vulnerability in the alg_ds crate: Matrix::new() drops uninitialized memory. Critical severity (CVSS 9.8). No fixed version: replace the crate or remove the affected code path.
| Crate | alg_ds |
|---|---|
| Type | Vulnerability |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-08-25 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-36432, GHSA-3vv3-frrq-6486 |
What to do
- Find who pulls it in:
cargo tree -i alg_ds. - Avoid the affected API, or replace the crate.
Details from the advisory
Matrix::new() internally calls Matrix::fill_with() which uses *ptr = value pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct.
References
- Package: crates.io/crates/alg_ds
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0033.html
- Report: gitlab.com/dvshapkin/alg-ds/-/issues/1
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?