RUSTSEC-2026-0292: Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics

What to do

1. See which version you have: cargo tree -i imbl-sized-chunks (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p imbl-sized-chunks. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example imbl-sized-chunks = "0.2.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Chunk::{clear, drop_left, drop_right} and InlineArray::{clear, truncate} drop the removed elements before updating the metadata that records which slots hold live values , the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update is never reached, so the collection still treats the already-dropped elements as live. When the collection is later dropped (its destructor walks the range described by the stale metadata), or a subsequent operation touches the same slots, those elements are dropped a second time , a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

The stale field is left and right for Chunk::clear, left for drop_left, right for drop_right, and the length field for both InlineArray methods.

Mitigation

Upgrade to imbl-sized-chunks 0.2.0 or later, which commits the metadata before dropping any element (fixed in jneem/imbl-sized-chunks#14, released in 0.2.0).

References

• Package: crates.io/crates/imbl-sized-chunks
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0292.html
• Web: github.com/jneem/imbl-sized-chunks/pull/14

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.