CVE-2026-6654
Fixed in a distro release EPSS <1%CVSS 5.1
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
Products: Mozilla thin-vec, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| crates.io | thin-vec | 0.2.16 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | cargo | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | clippy | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-analyzer | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-debugger-common | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-doc | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-gdb | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-src | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-std-static | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-toolset | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-toolset-srpm-macros | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | rustfmt | 1.95.0-1.amzn2.0.2 |
| Amazon Linux 2 | thunderbird | 140.10.0-1.amzn2.0.1 |
| Amazon Linux 2023 | cargo | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | clippy | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | firefox | 140.10.1-1.amzn2023.0.1 |
| Amazon Linux 2023 | rust | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-analyzer | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-debugger-common | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-doc | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-gdb | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-lldb | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-src | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-std-static | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-std-static-wasm32-unknown-unknown | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-std-static-wasm32-wasip1 | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-toolset | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-toolset-srpm-macros | 1.95.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rustfmt | 1.95.0-1.amzn2023.0.2 |
| Chainguard | ruff | 0.15.10-r0 |
| Chainguard | ruff | 0.15.11-r0 |
| Chainguard | ruff-python-formatter | 0.15.10-r0 |
| Chainguard | ruff-python-formatter | 0.15.11-r0 |
| Chainguard | rust-analyzer | 20260413-r1 |
| Chainguard | typst | 0.14.2-r5 |
| Debian 13 | rust-thin-vec | no fix |
| Debian 14 | rust-thin-vec | 0.2.17-1 |
| Ubuntu 24.04 LTS | rust-thin-vec | no fix |
| Ubuntu 25.10 | rust-thin-vec | no fix |
| Ubuntu 26.04 LTS | rust-thin-vec | no fix |
| Ubuntu 26.10 | rust-thin-vec | no fix |
| Wolfi | ruff | 0.15.11-r0 |
| Wolfi | ruff | 0.15.10-r0 |
| Wolfi | ruff-python-formatter | 0.15.11-r0 |
| Wolfi | ruff-python-formatter | 0.15.10-r0 |
| Wolfi | rust-analyzer | 20260413-r1 |