RUSTSEC-2026-0309: `SinglyLinkedList::remove` dereferences a null link

What to do

1. See which version you have: cargo tree -i bun_collections (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p bun_collections. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example bun_collections = "0.2.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, (*current_elm).next reads a null pointer. That is undefined behavior. The list head is a raw *mut Node<T>, and safe code can construct the empty list.

The maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional assert! before the pointer is followed, matching the upstream Zig unwrap on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.

References

• Package: crates.io/crates/bun_collections
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0309.html
• Report: github.com/putao520/bao/issues/46

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.