cloudflare / cloudflare/pingora
RUSTSEC-2026-0002: `IterMut` violates Stacked Borrows by invalidating internal pointer
- Dominant language
- Rust
- Stars
- 27.4k
- Forks
- 1.7k
- Avg merge
- 6h 22m
- Merged PRs (30d)
- 3
Description
> `IterMut` violates Stacked Borrows by invalidating internal pointer
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unsound |
| Package | `lru` |
| Version | `0.14.0` |
| URL | [https://github.com/jeromefroe/lru-rs/pull/224](https://github.com/jeromefroe/lru-rs/pull/224) |
| Date | 2026-01-07 |
Affected versions of this crate contain a soundness issue in the `IterMut`
iterator implementation. The `IterMut::next` and `IterMut::next_back`
methods temporarily create an exclusive reference to the key when
dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal `HashMap`,
violating Stacked Borrows rules.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0002.html) for additional details.
Contributor guide
Assessment
This issue has not been assessed yet.