Read the docs
TI-2025-43757 Aliases GHSA-xqjr-wfx3-gmxv

ArrayQueue's push_front is not panic-safe

Priority LOW 38CWE-665Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument. Specifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory. The bug was fixed in commit `728fe1b`.

Why it matters now

Fix Fixed array-queue (crates.io): 0.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—array-queue (crates.io)0.3.0 to before 0.4.00.4.0Patch availableGHSA-xqjr-wfx3-gmxv
  • array-queue (crates.io) Vendor— Affected 0.3.0 to before 0.4.0 Fixed in 0.4.0 Patch available GHSA-xqjr-wfx3-gmxv

Remediation

  • Fix · GHSA-xqjr-wfx3-gmxv array-queue (crates.io) Fixed in 0.4.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-xqjr-wfx3-gmxv

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences