{"id":"RUSTSEC-2026-0078","summary":"Symbol confusion after hasher panic in `intaglio` interners","details":"Affected versions of this crate can leave all `SymbolTable` variants in an\ninternally inconsistent state if a custom `BuildHasher` panics during\n`HashMap::insert` and the caller recovers with `catch_unwind`.\n\nThe `intern` implementations committed a `vec.push(...)` before the matching\n`map.insert(...)` completed. If hashing panicked in that window, later lookups\nand inserts could observe diverging `vec` and `map` lengths.\n\nIn release builds, this can lead to symbol confusion where a newly interned\nstring resolves to previously interned attacker-controlled contents. In debug\nbuilds, the same corruption is detected by follow-up assertions and results in\npanics.\n\nThe flaw was corrected in version 1.13.3 by making the `vec` mutation\ntransactional across unwind boundaries so partially inserted entries are rolled\nback before the panic propagates.","modified":"2026-04-25T07:30:06.201380Z","published":"2026-03-30T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/intaglio"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0078.html"},{"type":"REPORT","url":"https://github.com/artichoke/intaglio/issues/359"},{"type":"WEB","url":"https://github.com/artichoke/intaglio/pull/360"}],"affected":[{"package":{"name":"intaglio","ecosystem":"crates.io","purl":"pkg:cargo/intaglio"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.13.3"}]}],"ecosystem_specific":{"affects":{"arch":[],"functions":["intaglio::SymbolTable::intern","intaglio::bytes::SymbolTable::intern","intaglio::cstr::SymbolTable::intern","intaglio::osstr::SymbolTable::intern","intaglio::path::SymbolTable::intern"],"os":[]},"affected_functions":null},"database_specific":{"categories":[],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0078.json"}}],"schema_version":"1.7.5"}