NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🦀 crates.io
Not in CISA KEV

IdMap from_iter may lead to uninitialized memory being freed on dropGHSA-qq4c-hm99-979m

Fix: andrewhickman/id-map@fab6922

GHSA-qq4c-hm99-979m is a security vulnerability in id-map. A fix is available for id-map — see the affected versions and patch details below.

Also known asRUSTSEC-2025-0050
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 28, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🦀id-map

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Due to a flaw in the constructor id_map::IdMap::from_iter, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of IdMap. Specifically, the field ids is initialized based on the capacity of the vector values, which is constructed from the provided iterator. However, the length of this vector may be smaller than its capacity.

In such cases, when the resulting IdMap is dropped, its destructor incorrectly assumes that values contains ids.len() == values.capacity() initialized elements and attempts to iterate over and drop them. This leads to dereferencing and attempting to free uninitialized memory, resulting in undefined behavior and potential segmentation faults.

The bug was fixed in commit fab6922, and all unsafe code was removed from the crate.

Note that the maintainer recommends using the following alternatives:

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.ioid-map≥ 0.1.6&&< 0.2.20.2.2cargo update -p id-map --precise 0.2.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for id-map, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update id-map to 0.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qq4c-hm99-979m is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

Due to a flaw in the constructor `id_map::IdMap::from_iter`, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of `IdMap`. Specifically, the field `ids` is initialized based on the capacity of the vector `values`, which is constructed from the provided iterator. However, the length of this vector may be smaller than its capacity. In such cases, when the resulting `IdMap` is dropped, its destructor incorrectly assumes that `values` contains `ids.len() == values.capacity()` initialized elements and attempts to iterat
O3 Security · Impact-Aware SCA

Is GHSA-qq4c-hm99-979m in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works
IdMap from_iter may lead to uninitialized memory being…