CVE-2026-6654: thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

April 15, 2026 (updated April 27, 2026)

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

References

github.com/advisories/GHSA-xphw-cqx3-667j
github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j
nvd.nist.gov/vuln/detail/CVE-2026-6654
rustsec.org/advisories/RUSTSEC-2026-0103.html

Code Behaviors & Features

Detect and mitigate CVE-2026-6654 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →