GHSA-3632-54q8-m96x: Arenavec Arenavec Has Multiple Memory Corruption Vulnerability

HIGH
Share
CWE-415 CWE-822 CWE-122
Published
Advisory Summary

GHSA-3632-54q8-m96x is a HIGH arenavec has multiple memory corruption vulnerability (CWE-415: Double Free) affecting Arenavec libraries in the crates.io ecosystem. The issue involves arenavec has multiple memory corruption vulnerabilities in safe apis. Remediation is available in the latest vendor maintenance releases.

GHSA-3632-54q8-m96x at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-3632-54q8-m96x
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-415: Double Free
Affected Product Arenavec
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-3632-54q8-m96x

To remediate this vulnerability, upgrade all affected Arenavec dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

arenavec fixed: Latest secure release 
Upgrade arenavec to Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for arenavec

How to Check if You Are Affected

To determine whether your application is affected by GHSA-3632-54q8-m96x, inspect your project dependencies for Arenavec:

inspect dependencies for arenavec

Analyze the terminal output to locate any version of Arenavec in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-415: Double Free, where the product calls free() twice on the same memory address. In Arenavec, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The crate has the following vulnerabilities: - The public trait `arenavec::common::AllocHandle` allows the return of raw pointers through its methods `allocate` and `allocate_or_extend`. However, the trait is not marked as unsafe, meaning users of the crate may implement it under the assumption that the library safely handles the returned raw pointers. These raw pointers can later be dereferenced within safe APIs of the crate-such as `arenavec::common::SliceVec::push`-potentially leading to arbitrary memory access. - The safe API `arenavec::common::SliceVec::reserve` can reach the private function `arenavec::common::allocate_inner`. Incorrect behavior in `allocate_inner` may result in a `SliceVec` with an increased capacity, even though the underlying memory has not actually been expanded. This mismatch between `SliceVec.capacity` and the actual reserved memory can lead to a heap buffer overflow. - The safe API `arenavec::common::SliceVec::split_off` can duplicate the ownership of the elements in `self` (of type `SliceVec`) if they implement the `Drop` trait. Specifically, when `at == 0`, the method returns a new `SliceVec` with the same length as `self`. Since both `self` and the returned object point to the same heap memory, dropping one will deallocate the shared memory. When the other is subsequently dropped, it will attempt to free the same memory again, resulting in a double free violation.

GHSA-3632-54q8-m96x Affected Arenavec Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
arenavec
 crates.io
≤ 0.1.1

References

Arenavec Source Repository REPOSITORY
https://github.com/ibabushkin/arenavec/issues/4
Arenavec Source Repository REPOSITORY
https://github.com/ibabushkin/arenavec/issues/5
Arenavec Source Repository REPOSITORY
https://github.com/ibabushkin/arenavec/issues/6
Arenavec Source Repository REPOSITORY
https://github.com/ibabushkin/arenavec
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2025-0053.html

Frequently Asked Questions

What is GHSA-3632-54q8-m96x?
GHSA-3632-54q8-m96x is a security vulnerability in Arenavec involving arenavec has multiple memory corruption vulnerabilities in safe APIs under CWE-415: Double Free.
Which Arenavec versions are affected?
Affected versions include releases prior to current release patches across affected packages: arenavec.
What version fixes GHSA-3632-54q8-m96x?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is arenavec affected?
Yes, arenavec is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with GHSA-3632-54q8-m96x?
GHSA-3632-54q8-m96x is classified under CWE-415: Double Free (The product calls free() twice on the same memory address.).
How can I check crates.io dependencies for GHSA-3632-54q8-m96x?
Run the dependency tree command: 'inspect dependencies for arenavec'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3632-54q8-m96x",
  "modified" : "2025-09-02T17:22:36Z",
  "published" : "2025-09-02T17:22:36Z",
  "aliases" : [ ],
  "summary" : "arenavec has multiple memory corruption vulnerabilities in safe APIs",
  "details" : "The crate has the following vulnerabilities:\n\n- The public trait `arenavec::common::AllocHandle` allows the return of raw pointers through its methods `allocate` and `allocate_or_extend`. However, the trait is not marked as unsafe, meaning users of the crate may implement it under the assumption that the library safely handles the returned raw pointers. These raw pointers can later be dereferenced within safe APIs of the crate-such as `arenavec::common::SliceVec::push`-potentially leading to arbitrary memory access.\n\n- The safe API `arenavec::common::SliceVec::reserve` can reach the private function `arenavec::common::allocate_inner`. Incorrect behavior in `allocate_inner` may result in a `SliceVec` with an increased capacity, even though the underlying memory has not actually been expanded. This mismatch between `SliceVec.capacity` and the actual reserved memory can lead to a heap buffer overflow.\n\n- The safe API `arenavec::common::SliceVec::split_off` can duplicate the ownership of the elements in `self` (of type `SliceVec`) if they implement the `Drop` trait. Specifically, when `at == 0`, the method returns a new `SliceVec` with the same length as `self`. Since both `self` and the returned object point to the same heap memory, dropping one will deallocate the shared memory. When the other is subsequently dropped, it will attempt to free the same memory again, resulting in a double free violation.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "arenavec"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "0.1.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ibabushkin/arenavec/issues/4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ibabushkin/arenavec/issues/5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ibabushkin/arenavec/issues/6"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ibabushkin/arenavec"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2025-0053.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-122", "CWE-415", "CWE-822" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-02T17:22:36Z",
    "nvd_published_at" : null
  }
}