RUSTSEC-2023-0016: Possible out-of-bounds read in release mode

What to do

1. See which version you have: cargo tree -i partial_sort (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p partial_sort. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example partial_sort = "0.2.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of this crate were using a debug assertion to validate the last parameter of partial_sort(). This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.

All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.

The accessible region is further limited by an initial bounds-checked read at (last / 2) - 1, i.e., it is proportional to the size of the vector.

This bug has been fixed in v0.2.0.

References

• Package: crates.io/crates/partial_sort
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0016.html
• Report: github.com/sundy-li/partial_sort/issues/7

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.