GHSA-xqjr-wfx3-gmxv: Array queue ArrayQueue's Push_front Is Not Panic-safe Vulnerability

MODERATE
Share
CWE-665
Published
Advisory Summary

GHSA-xqjr-wfx3-gmxv is a MODERATE arrayqueue's push_front is not panic-safe vulnerability (CWE-665: Improper Initialization) affecting Array queue libraries in the crates.io ecosystem. The issue involves arrayqueue's push_front is not panic-safe. Remediation is available by upgrading affected packages to version 0.4.0.

GHSA-xqjr-wfx3-gmxv at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-xqjr-wfx3-gmxv
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-665: Improper Initialization
Affected Product Array queue
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-xqjr-wfx3-gmxv

To remediate this vulnerability, upgrade all affected Array queue dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

array-queue fixed: 0.4.0 
Upgrade array-queue to 0.4.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for array-queue

How to Check if You Are Affected

To determine whether your application is affected by GHSA-xqjr-wfx3-gmxv, inspect your project dependencies for Array queue:

inspect dependencies for array-queue

Analyze the terminal output to locate any version of Array queue in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.4.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-665: Improper Initialization, where the product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. In Array queue, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument. Specifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory. The bug was fixed in commit `728fe1b`.

GHSA-xqjr-wfx3-gmxv Affected Array queue Versions

1 component(s)
Fixed Versions:
0.4.0
Product / Package Ecosystem Affected Versions Fixed Version
array-queue
 crates.io
≥ 0.3.0
< 0.4.0
0.4.0

References

Array queue Source Repository REPOSITORY
https://github.com/raviqqe/array-queue/issues/3
Security Fix Commit FIX COMMIT
https://github.com/raviqqe/array-queue/commit/728fe1bdffb04896d218e962d989a2ae6bf1ea92
Array queue Source Repository REPOSITORY
https://github.com/raviqqe/array-queue
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2025-0054.html

Frequently Asked Questions

What is GHSA-xqjr-wfx3-gmxv?
GHSA-xqjr-wfx3-gmxv is a security vulnerability in Array queue involving ArrayQueue's push_front is not panic-safe under CWE-665: Improper Initialization.
Which Array queue versions are affected?
Affected versions include releases prior to 0.4.0 across affected packages: array-queue.
What version fixes GHSA-xqjr-wfx3-gmxv?
Upgrading to 0.4.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is array-queue affected?
Yes, array-queue is affected in releases prior to 0.4.0. Upgrade your dependency to 0.4.0 or later.
What CWE is associated with GHSA-xqjr-wfx3-gmxv?
GHSA-xqjr-wfx3-gmxv is classified under CWE-665: Improper Initialization (The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.).
How can I check crates.io dependencies for GHSA-xqjr-wfx3-gmxv?
Run the dependency tree command: 'inspect dependencies for array-queue'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xqjr-wfx3-gmxv",
  "modified" : "2025-09-02T17:35:16Z",
  "published" : "2025-09-02T17:35:16Z",
  "aliases" : [ ],
  "summary" : "ArrayQueue's push_front is not panic-safe",
  "details" : "The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.\n\nSpecifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.\n\nThe bug was fixed in commit `728fe1b`.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "array-queue"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.3.0"
      }, {
        "fixed" : "0.4.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/raviqqe/array-queue/issues/3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/raviqqe/array-queue/commit/728fe1bdffb04896d218e962d989a2ae6bf1ea92"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/raviqqe/array-queue"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2025-0054.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-665" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-02T17:35:16Z",
    "nvd_published_at" : null
  }
}