Vulnerability MediumRUSTSEC-2020-0047 · array-queue
RUSTSEC-2020-0047: array_queue pop_back() may cause a use-after-free
Short answerA security vulnerability in the array-queue crate: array_queue pop_back() may cause a use-after-free. Medium severity (CVSS 5.5). No fixed version: replace the crate or remove the affected code path.
| Crate | array-queue |
|---|---|
| Type | Vulnerability |
| Affected versions | From 0.3.0 onward (every version). |
| Fixed in | none |
| Severity | Medium, CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published | 2020-09-26 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-35900, GHSA-75cq-g75g-rxff |
What to do
- Find who pulls it in:
cargo tree -i array-queue. - Avoid the affected API, or replace the crate.
Details from the advisory
array_queue implements a circular queue that wraps around an array. However, it fails to properly index into the array in the pop_back function allowing the reading of previously dropped or uninitialized memory.
References
- Package: crates.io/crates/array-queue
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0047.html
- Report: github.com/raviqqe/array-queue/issues/2
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for array-queue
Up next
Same cratearray-queue: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?