high7.5
CVE-2021-31996
Double free in algorithmica
Impact
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation, simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | algorithmica | <= 0.1.8 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Algorithmica Project | Algorithmica | through 2021-03-07 |