Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 6.9, published 15 May 2026.
- Which products and versions are affected?
- rkyv (crates.io) >= 0.8.0, < 0.8.16.
- Is there a fix for This vulnerability?
- A patch was published on 2026-05-15: Version 0.8.16 released and GHSA published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run rkyv (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The `InlineVec::clear` and `SerVec::clear` functions in rkyv are not panic-safe. These functions iterate through elements and call `drop_in_place` on each, but only update the internal length counter after the loop completes. If an element's `Drop` implementation panics, the length remains at its original value. This leads to a double-free or use-after-free scenario when the container is dropped or cleared again, as the already-dropped elements are processed a second time. The vulnerability is triggerable from safe Rust using `std::panic::catch_unwind` and was fixed in version 0.8.16 by updating the length before dropping elements.
Affected products
- rkyv rkyv >= 0.8.0, < 0.8.16
Timeline
- 2026-04-23: other: Reported
- 2026-05-11: advisory: RustSec advisory issued
- 2026-05-15: patched: Version 0.8.16 released and GHSA published