RUSTSEC-2021-0022: Use-after-free in `subscript_next` and `subscript_prev` wrappers

What to do

1. See which version you have: cargo tree -i yottadb (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p yottadb. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example yottadb = "1.2.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of this crate had an unsound implementation which could pass a pointer to freed memory to ydb_subscript_next_st and ydb_subscript_prev_st if the variable and subscripts did not have enough memory allocated on the first call to hold the next variable in the database.

For example, the following code had undefined behavior:

let mut key = Key::variable(String::from("a"));
Key::variable("averylongkeywithlotsofletters")
    .set_st(YDB_NOTTP, Vec::new(), b"some val")
    .unwrap();
key.sub_next_self_st(YDB_NOTTP, Vec::new()).unwrap();

yottadb has no reverse-dependencies on crates.io and there are no known instances of this API being used incorrectly in practice. The fix is backwards compatible.

The flaw was corrected by recalculating the pointer each time it was reallocated.

References

• Package: crates.io/crates/yottadb
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0022.html
• Report: gitlab.com/YottaDB/Lang/YDBRust/-/issues/40

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.