CVE-2026-6654

Name	CVE-2026-6654
Description	Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1134494

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-thin-vec (PTS)	forky, sid, trixie	0.2.13-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-thin-vec	source	(unstable)	(unfixed)			1134494

Notes

https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j
Fixed by: https://github.com/mozilla/thin-vec/commit/df64748355222525c344ecd9d2c9f59a662e1678 (v0.2.16)