{"id":"GHSA-rhfx-m35p-ff5j","aliases":["RUSTSEC-2026-0002"],"url":"https://o3.security/vulnerability/GHSA-rhfx-m35p-ff5j","summary":"`IterMut` violates Stacked Borrows by invalidating internal pointer","details":"Affected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.\n\nThis invalidates the shared pointer held by the internal `HashMap`, violating Stacked Borrows rules.","published":"2026-01-07T20:38:57Z","modified":"2026-09-10T03:50:59.064354050Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"lru","fixedVersion":"0.16.3"}],"fix":{"url":"https://github.com/jeromefroe/lru-rs/pull/224","label":"jeromefroe/lru-rs#224"},"references":[{"type":"WEB","url":"https://github.com/jeromefroe/lru-rs/pull/224"},{"type":"PACKAGE","url":"https://github.com/jeromefroe/lru-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0002.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:59.064354050Z"}}