https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 16:19:39 +0000 https://cve.radiocsirt.org/vuln/cve-2021-29935 <p>An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.</p> <p>An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.</p> https://cve.radiocsirt.org/vuln/cve-2021-29935 https://cve.radiocsirt.org/vuln/rustsec-2021-0044 <p><strong>Affected:</strong> crates.io: rocket</p> <p>Affected versions of this crate transmuted a `&amp;str` to a `&amp;&#39;static str` before pushing it into a `StackVec`, this value was then popped later in the same function.</p> <p>This was assumed to be safe because the reference would be valid while the method&#39;s stack was active. In between the push and the pop, however, a function `f` was called that could invoke a user provided function.</p> <p>If the user provided panicked, then the assumption used by the function was no longer true and the transmute to `&amp;&#39;static` would create an illegal static reference to the string. This could result in a freed string being used during (such as in a `Drop` implementation) or after (e.g through `catch_unwind`) the panic unwinding.</p> <p>This flaw was corrected in commit [e325e2f](https://github.com/SergioBenitez/Rocket/commit/e325e2fce4d9f9f392761e9fb58b418a48cef8bb) by using a guard object to ensure that the `&amp;&#39;static str` was dropped inside the function.</p> <p><strong>Affected:</strong> crates.io: rocket</p> <p>Affected versions of this crate transmuted a `&amp;str` to a `&amp;&#39;static str` before pushing it into a `StackVec`, this value was then popped later in the same function.</p> <p>This was assumed to be safe because the reference would be valid while the method&#39;s stack was active. In between the push and the pop, however, a function `f` was called that could invoke a user provided function.</p> <p>If the user provided panicked, then the assumption used by the function was no longer true and the transmute to `&amp;&#39;static` would create an illegal static reference to the string. This could result in a freed string being used during (such as in a `Drop` implementation) or after (e.g through `catch_unwind`) the panic unwinding.</p> <p>This flaw was corrected in commit [e325e2f](https://github.com/SergioBenitez/Rocket/commit/e325e2fce4d9f9f392761e9fb58b418a48cef8bb) by using a guard object to ensure that the `&amp;&#39;static str` was dropped inside the function.</p> https://cve.radiocsirt.org/vuln/rustsec-2021-0044