RUSTSEC-2025-0050: IdMap::from_iter may lead to uninitialized memory being freed on drop

What to do

1. See which version you have: cargo tree -i id-map (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p id-map. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example id-map = "0.2.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Due to a flaw in the constructor id_map::IdMap::from_iter, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of IdMap. Specifically, the field ids is initialized based on the capacity of the vector values, which is constructed from the provided iterator. However, the length of this vector may be smaller than its capacity.

In such cases, when the resulting IdMap is dropped, its destructor incorrectly assumes that values contains ids.len() == values.capacity() initialized elements and attempts to iterate over and drop them. This leads to dereferencing and attempting to free uninitialized memory, resulting in undefined behavior and potential segmentation faults.

The bug was fixed in commit fab6922, and all unsafe code was removed from the crate.

Note that the maintainer recommends using the following alternatives:

• slab
• slotmap

References

• Package: crates.io/crates/id-map
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0050.html
• Report: github.com/andrewhickman/id-map/issues/4

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for id-map

• VulnerabilityRUSTSEC-2021-0052 · 2021-02-26Multiple functions can cause double-frees

Full security history of id-map