Read the docs
TI-2025-43619 Aliases GHSA-vgmh-mqm4-8j88

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Priority LOW 38CWE-416Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from `alloc::sync::Arc` and `alloc::rc::Rc`, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes. This projected pointer could cause the original `Arc`'s or `Rc`'s `Drop::drop` to get called at a point where the original data was no longer valid, leading to a potential use after free. The affected functions were - `pared::prc::Prc::from_rc` - `pared::prc::Prc::project` - `pared::prc::Prc::try_from_rc` - `pared::sync::Parc::from_arc` - `pared::sync::Parc::project` - `pared::sync::Parc::try_from_arc` This flaw was fixed in [108f540ea8acb6073751a1aa386085c1cdc4fd1e](https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e) by requiring that the type stored in the `Arc`s and `Rc`s passed to these functions contain `T: 'static`.

Why it matters now

Fix Fixed pared (crates.io): 0.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—pared (crates.io)before 0.4.00.4.0Patch availableGHSA-vgmh-mqm4-8j88
  • pared (crates.io) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-vgmh-mqm4-8j88

Remediation

  • Fix · GHSA-vgmh-mqm4-8j88 pared (crates.io) Fixed in 0.4.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-vgmh-mqm4-8j88

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences