Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 6.3, published 8 July 2026.
- Which products and versions are affected?
- oneringbuf (crates.io) < 0.8.0.
- Is there a fix for This vulnerability?
- A patch was published on 2026-07-08: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked with local access, in a software library.
- Am I affected?
- Check whether you run oneringbuf (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free vulnerability exists in oneringbuf versions prior to 0.8.0. The library exposed the obsolete 'IntoRef::into_ref' method, which returns a 'DroppableRef' handle for heap-backed ring buffers. This handle uses a raw pointer and a manual reference counter ('alive_iters'). However, the 'Clone' implementation for 'DroppableRef' fails to increment this counter. Consequently, when one clone is dropped, it may trigger a 'Box::from_raw' call that frees the underlying allocation while other clones still exist. Subsequent access or dropping of the remaining clones results in a heap-use-after-free. The vulnerability is reachable via safe Rust code and was fixed in version 0.8.0 by removing the 'into_ref' method.
Affected products
- Skilvingr oneringbuf < 0.8.0
Timeline
- 2026-05-27: other: Reported
- 2026-06-01: advisory: RustSec advisory issued
- 2026-07-08: disclosed: GitHub Advisory published
- 2026-07-08: patched: Version 0.8.0 released