Rust advisories / vec-const
Unsound MediumRUSTSEC-2021-0082 · vec-const
RUSTSEC-2021-0082: vec-const attempts to construct a Vec from a pointer to a const slice
Short answervec-const has an API that can cause undefined behaviour from safe code: vec-const attempts to construct a Vec from a pointer to a const slice. Fixed in 2.0.0.
| Crate | vec-const |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Before 2.0.0. |
| Fixed in | 2.0.0 |
| Severity | Medium (GitHub rating) |
| Published | 2021-08-14 |
| Last changed | 2025-12-17 |
| Also known as | CVE-2021-45680, GHSA-jmwx-r3gq-qq3p, GHSA-x76r-966h-5qv9 |
What to do
- See which version you have:
cargo tree -i vec-const(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p vec-const. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplevec-const = "2.0.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions of this crate claimed to construct a const Vec with nonzero length and capacity, but that cannot be done because such a Vec requires a pointer from an allocator.
The implementation was later changed to just construct a std::borrow::Cow.
References
- Package: crates.io/crates/vec-const
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0082.html
- Report: github.com/Eolu/vec-const/issues/1#issuecomment-898908241
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?