Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 2 September 2026.

Which products and versions are affected?

skiplist (crates.io) <1.1.1, SEMVER:introduced=0.0.0-0,fixed=1.1.1.

Is there a fix for This vulnerability?

Yes. skiplist (crates.io): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run skiplist (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

skiplist use-after-free in clear and retain with panicking Drop

Q: Is there a fix for This vulnerability?

Yes. skiplist (crates.io): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked with local access, in a software library.

Q: Am I affected?

Check whether you run skiplist (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: info · Published 2026-09-02

The skiplist Rust library contains memory safety bugs in its clear, retain, and dedup_by methods. If an element's destructor panics during these operations, the container can enter an unsafe state where freed memory is still referenced, potentially allowing an attacker to read or corrupt sensitive data. Applications using skiplist are vulnerable if they store types with fallible destructors.

Technologies: skiplist (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 2 September 2026.
Which products and versions are affected?: skiplist (crates.io) <1.1.1, SEMVER:introduced=0.0.0-0,fixed=1.1.1.
Is there a fix for This vulnerability?: Yes. skiplist (crates.io): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run skiplist (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

skiplist (crates.io): upgrade to 1.1.1 or later
```
cargo update -p skiplist
```

Technical details

The vulnerability is a use-after-free (CWE-416) and double-free (CWE-415) arising from improper state management when dropping elements. In clear(), the node chain is dropped before tail and len are reset; if a Drop implementation panics, tail still points to freed memory while the container remains accessible. Similarly, retain/retain_mut/dedup_by free nodes and run user predicates via Node::filter_rebuild before committing state changes, leaving head links partially rewired. Unsafe code dereferencing tail through back(), back_mut(), last_key_value(), and last() then accesses freed memory. This is patched in version 1.1.1.

Affected products

crates.io skiplist <1.1.1

Timeline

2026-09-02: disclosed
2026-09-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.