Rust advisories / owning_ref
Vulnerability MediumRUSTSEC-2022-0040 · owning_ref
RUSTSEC-2022-0040: Multiple soundness issues in `owning_ref`
Short answerA security vulnerability in the owning_ref crate: Multiple soundness issues in `owning_ref`. GitHub rates it Medium. No fixed version: replace the crate or remove the affected code path.
| Crate | owning_ref |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2022-01-26 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-9qxh-258v-666c |
What to do
- Find who pulls it in:
cargo tree -i owning_ref. - Avoid the affected API, or replace the crate.
Details from the advisory
OwningRef::map_with_owneris unsound and may result in a use-after-free.OwningRef::mapis unsound and may result in a use-after-free.OwningRefMut::as_ownerandOwningRefMut::as_owner_mutare unsound and may result in a use-after-free.- The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM
noaliasattribute.
safer_owning_ref is a replacement crate which fixes these issues. No patched versions of the original crate are available, and the maintainer is unresponsive.
References
- Package: crates.io/crates/owning_ref
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0040.html
- Web: github.com/noamtashma/owning-ref-unsoundness
- Report: github.com/Kimundi/owning-ref-rs/issues/49
- Report: github.com/Kimundi/owning-ref-rs/issues/61
- Report: github.com/Kimundi/owning-ref-rs/issues/71
- Report: github.com/Kimundi/owning-ref-rs/issues/77
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?