https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 17:11:54 +0000 https://cve.radiocsirt.org/vuln/cve-2021-29935 <p>An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.</p> <p>An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.</p> https://cve.radiocsirt.org/vuln/cve-2021-29935 https://cve.radiocsirt.org/vuln/ghsa-vcw4-8ph6-7vw8 <p><strong>Affected:</strong> crates.io: rocket</p> <p>Affected versions of this crate transmuted a &amp;str to a &amp;&#39;static str before pushing it into a StackVec, this value was then popped later in the same function.</p> <p>This was assumed to be safe because the reference would be valid while the method&#39;s stack was active. In between the push and the pop, however, a function f was called that could invoke a user provided function.</p> <p>If the user provided panicked, then the assumption used by the function was no longer true and the transmute to &amp;&#39;static would create an illegal static reference to the string. This could result in a freed string being used during (such as in a Drop implementation) or after (e.g through catch_unwind) the panic unwinding.</p> <p>This flaw was corrected in commit `e325e2f` by using a guard object to ensure that the &amp;&#39;static str was dropped inside the function.</p> <p><strong>Affected:</strong> crates.io: rocket</p> <p>Affected versions of this crate transmuted a &amp;str to a &amp;&#39;static str before pushing it into a StackVec, this value was then popped later in the same function.</p> <p>This was assumed to be safe because the reference would be valid while the method&#39;s stack was active. In between the push and the pop, however, a function f was called that could invoke a user provided function.</p> <p>If the user provided panicked, then the assumption used by the function was no longer true and the transmute to &amp;&#39;static would create an illegal static reference to the string. This could result in a freed string being used during (such as in a Drop implementation) or after (e.g through catch_unwind) the panic unwinding.</p> <p>This flaw was corrected in commit `e325e2f` by using a guard object to ensure that the &amp;&#39;static str was dropped inside the function.</p> https://cve.radiocsirt.org/vuln/ghsa-vcw4-8ph6-7vw8