{"id":"RUSTSEC-2026-0198","summary":"`Report::frames_mut` allows aliased mutable references","details":"Affected versions of this crate return an iterator from\n`Report::frames_mut` whose `&mut Frame` items have lifetimes independent\nof the iterator, so all yielded references can be held at the same time.\nA yielded frame's sources are also yielded by the iterator and reachable\nthrough the parent frame via `Frame::sources_mut`, allowing safe code to\nobtain two live mutable references to the same frame. This is undefined\nbehavior and can be used to cause a segmentation fault (see reproducer in\nthe linked issue). Versions 0.1.0 and 0.1.1 are affected through\n`Frame::source_mut` instead of `Frame::sources_mut`.\n\nThe flaw is fixed in 0.8.0 by replacing the iterator with internal\niteration: `Report::frames_mut` now takes a visitor closure, so mutable\naccess to a frame is scoped and cannot overlap with access to its\nsources.","modified":"2026-07-03T15:34:08.180969937Z","published":"2026-07-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/error-stack"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0198.html"},{"type":"REPORT","url":"https://github.com/hashintel/hash/issues/8945"},{"type":"WEB","url":"https://github.com/hashintel/hash/pull/8946"}],"affected":[{"package":{"name":"error-stack","ecosystem":"crates.io","purl":"pkg:cargo/error-stack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.8.0"}]}],"ecosystem_specific":{"affects":{"functions":["error_stack::Report::frames_mut"],"arch":[],"os":[]},"affected_functions":null},"database_specific":{"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0198.json","categories":["memory-corruption"],"cvss":null}}],"schema_version":"1.7.5"}