RUSTSEC-2023-0057: Fails to prohibit standard library access prior to initialization of Rust standard library runtime

What to do

1. See which version you have: cargo tree -i inventory (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p inventory. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example inventory = "0.2.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions allow arbitrary caller-provided code to execute before the lifetime of main.

If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are likely; UB is possible.

The flaw was corrected by enforcing that only code written within the inventory crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before main. Caller-provided code is restricted to running at compile time.

References

• Package: crates.io/crates/inventory
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0057.html
• Web: github.com/dtolnay/inventory/pull/43

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for inventory

• UnsoundRUSTSEC-2023-0058 · 2023-09-10Exposes reference to non-Sync data to an arbitrary thread

Full security history of inventory