UnsoundRUSTSEC-2023-0126 · im
RUSTSEC-2023-0126: Aliasing violation in `OrdSet` insertion
Short answerim has an API that can cause undefined behaviour from safe code: Aliasing violation in `OrdSet` insertion. No fixed version yet.
| Crate | im |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored |
| Published | 2023-02-04 |
| Last changed | 2026-08-10 |
| Also known as | none |
What to do
- Find who pulls it in:
cargo tree -i im. - Avoid the affected API, or replace the crate.
Details from the advisory
Inserting into an im::OrdSet (for example by collecting an iterator into one) can violate Rust's aliasing rules: Miri reports a stacked borrows violation in sized_chunks::Chunk::force_copy(), which is called during insertion, where a shared borrow is invalidated by a unique borrow before the read through it completes. This is undefined behavior, reachable from safe code.
No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.
References
- Package: crates.io/crates/im
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0126.html
- Report: github.com/bodil/im-rs/issues/207
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for im
Up next
Same crateim: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?