RUSTSEC-2022-0078: Use-after-free due to a lifetime error in `Vec::into_iter()`

What to do

1. See which version you have: cargo tree -i bumpalo (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p bumpalo. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example bumpalo = "3.11.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

In affected versions of this crate, the lifetime of the iterator produced by Vec::into_iter() is not constrained to the lifetime of the Bump that allocated the vector's memory. Using the iterator after the Bump is dropped causes use-after-free accesses.

The following example demonstrates memory corruption arising from a misuse of this unsoundness.

use bumpalo::{collections::Vec, Bump};

fn main() {
    let bump = Bump::new();
    let mut vec = Vec::new_in(&bump);
    vec.extend([0x01u8; 32]);
    let into_iter = vec.into_iter();
    drop(bump);

    for _ in 0..100 {
        let reuse_bump = Bump::new();
        let _reuse_alloc = reuse_bump.alloc([0x41u8; 10]);
    }

    for x in into_iter {
        print!("0x{:02x} ", x);
    }
    println!();
}

The issue was corrected in version 3.11.1 by adding a lifetime to the IntoIter type, and updating the signature of Vec::into_iter() to constrain this lifetime.

References

• Package: crates.io/crates/bumpalo
• Advisory: rustsec.org/advisories/RUSTSEC-2022-0078.html
• Web: github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md#3111

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for bumpalo

• Vulnerability HighRUSTSEC-2020-0006 · 2020-03-24Flaw in `realloc` allows reading unknown memory

Full security history of bumpalo