GHSA-xphw-cqx3-667j: thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

April 15, 2026

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

References

github.com/advisories/GHSA-xphw-cqx3-667j
github.com/mozilla/thin-vec
github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j

Code Behaviors & Features

Detect and mitigate GHSA-xphw-cqx3-667j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →