{"id":"GHSA-xqjr-wfx3-gmxv","summary":"ArrayQueue's push_front is not panic-safe","details":"The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.\n\nSpecifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.\n\nThe bug was fixed in commit `728fe1b`.","aliases":["RUSTSEC-2025-0054"],"modified":"2025-10-28T06:29:27.045607Z","published":"2025-09-02T17:35:16Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-09-02T17:35:16Z","nvd_published_at":null,"cwe_ids":["CWE-665"]},"references":[{"type":"WEB","url":"https://github.com/raviqqe/array-queue/issues/3"},{"type":"WEB","url":"https://github.com/raviqqe/array-queue/commit/728fe1bdffb04896d218e962d989a2ae6bf1ea92"},{"type":"PACKAGE","url":"https://github.com/raviqqe/array-queue"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0054.html"}],"affected":[{"package":{"name":"array-queue","ecosystem":"crates.io","purl":"pkg:cargo/array-queue"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.4.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-xqjr-wfx3-gmxv/GHSA-xqjr-wfx3-gmxv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}