Rust advisories / emap
UnsoundRUSTSEC-2026-0128 · emap
RUSTSEC-2026-0128: Double-free and use-after-free in `Keys::next()`
Short answeremap has an API that can cause undefined behaviour from safe code: Double-free and use-after-free in `Keys::next()`. No fixed version yet.
| Crate | emap |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-05-02 |
| Last changed | 2026-05-13 |
| Also known as | none |
What to do
- Find who pulls it in:
cargo tree -i emap. - Avoid the affected API, or replace the crate.
Details from the advisory
Keys::next() uses ptr::read to move out the Option<V> by value, which drops the contained V when V is non-Copy (e.g. String). This leaves a dangling value in the map's storage slot. Subsequent get() operations on that key return a dangling reference to already-freed memory.
This can be triggered through safe public APIs , Map::keys(), Keys::next(), and Map::get() , with no unsafe required from the caller. Under Miri, accessing the freed slot produces "Undefined Behavior: pointer not dereferenceable: alloc has been freed, so this pointer is dangling".
References
- Package: crates.io/crates/emap
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0128.html
- Report: github.com/yegor256/emap/issues/168
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?