CVE-2019-16882 is a high-severity (CVSS 7.5) Use After Free vulnerability in string-interner. 1 public exploit reference exists, so weaponization risk is real. A fix is available for string-interner — see the affected versions and patch details below.
Use after free in string-interner
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2019-16882 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
string-interner🦀string-internerReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Affected versions of this crate did not clone contained strings when an interner is cloned. Interners have raw pointers to the contained strings, and they keep pointing the strings which the old interner owns, after the interner is cloned. If a new cloned interner is alive and the old original interner is dead, the new interner has dangling pointers to the old interner's storage, which is already dropped.
This allows an attacker to read the already freed memory. The dangling pointers are used by the interners to check a string is already interned. An attacker can do brute force attack to get the data pointed by the dangling pointer.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | string-interner | ≥ 0.7.0&&< 0.7.1 | 0.7.1cargo update -p string-interner --precise 0.7.1 |
| 🦀crates.io | string-interner | all versions | 0.6.4cargo update -p string-interner --precise 0.6.4 |
Affected Products
string-internerstring-interner_projectResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for string-interner, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update string-interner to 0.7.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-16882 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Frequently Asked Questions
Is CVE-2019-16882 in your dependencies?
Find it across crates.io, including transitive dependencies.