Rust advisories / stack-graphs
UnsoundRUSTSEC-2026-0302 · stack-graphs
RUSTSEC-2026-0302: `stack-graphs` C API exports are safe `extern "C"` functions
Short answerstack-graphs has an API that can cause undefined behaviour from safe code: `stack-graphs` C API exports are safe `extern "C"` functions. No fixed version yet.
| Crate | stack-graphs |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | From 0.0.3 onward (every version). |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-09-22 |
| Last changed | 2026-09-22 |
| Also known as | none |
| Affected functions | stack_graphs::c::sg_stack_graph_free |
What to do
- Find who pulls it in:
cargo tree -i stack-graphs. - Avoid the affected API (
stack_graphs::c::sg_stack_graph_free), or replace the crate.
Details from the advisory
stack_graphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them.
sg_stack_graph_free frees the pointer with Box::from_raw. sg_stack_graph_free(std::ptr::null_mut()) is immediate undefined behavior. The same shape is used by the other *_free exports and by getters and mutators that dereference the caller-supplied pointer or pass it to from_raw_parts (sg_stack_graph_nodes, sg_stack_graph_add_edges, and the rest of the pointer-taking functions in src/c.rs). Constructors that take no pointer are not part of this issue.
The upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export unsafe extern "C" fn, with a safety comment that the pointer is non-null and, for free, came from the matching constructor.
References
- Package: crates.io/crates/stack-graphs
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0302.html
- Report: github.com/rustsec/advisory-db/issues/3241
- Web: github.com/github/stack-graphs
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for stack-graphs
Up next
Same cratestack-graphs: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?