RUSTSEC-2025-0016: Use after free in `Parc` and `Prc` due to missing lifetime constraints

What to do

1. See which version you have: cargo tree -i pared (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p pared. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example pared = "0.4.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

• pared::prc::Prc::from_rc
• pared::prc::Prc::project
• pared::prc::Prc::try_from_rc
• pared::sync::Parc::from_arc
• pared::sync::Parc::project
• pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

References

• Package: crates.io/crates/pared
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0016.html
• Report: github.com/radekvit/pared/issues/2

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.