RUSTSEC-2026-0274: Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics

What to do

1. See which version you have: cargo tree -i rtrb (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rtrb. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rtrb = "0.4.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

ReadChunk::commit and ReadChunk::commit_all drop the committed elements before advancing the consumer head. If an element's Drop panics during the drop loop, head is never advanced, so the ring buffer still treats those slots as holding live elements. When the RingBuffer is later dropped (it walks head..tail and drops each slot), or a subsequent read_chunk() / commit() touches the same slots, the already-dropped elements are dropped a second time , a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

Mitigation

Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.

References

• Package: crates.io/crates/rtrb
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0274.html
• Report: github.com/mgeier/rtrb/issues/185

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.