RUSTSEC-2026-0122: Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`

What to do

1. See which version you have: cargo tree -i rkyv (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rkyv. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rkyv = "0.8.16") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call drop_in_place on each, updating self.len only *after* the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the already-freed elements:

• InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped.
• SerVec::clear() is called again by SerVec::with_capacity() after the user closure returns.

Impact

• **CWE-415 (Double Free):** heap corruption when the element type is one that owns memory, such as Box<T> or Vec<T>
• **CWE-416 (Use-After-Free):** memory corruption when an element is accessed following a caught panic

Both types of undefined behavior can be invoked in safe Rust, but only if unwinding panics are enabled and std::panic::catch_unwind is used.

References

• Package: crates.io/crates/rkyv
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0122.html
• Web: github.com/rkyv/rkyv/commit/5828cf5c27b664eb4432c4a93d4769e12e5e42fb

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rkyv

• Vulnerability HighRUSTSEC-2021-0054 · 2021-04-28Archives may contain uninitialized memory
• VulnerabilityRUSTSEC-2026-0001 · 2026-01-05Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
• VulnerabilityRUSTSEC-2026-0233 · 2026-05-11Crafted archives can cause a use-after-free during deserialization
• VulnerabilityRUSTSEC-2026-0234 · 2026-05-11Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
• VulnerabilityRUSTSEC-2026-0235 · 2026-05-13Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Full security history of rkyv