{"id":"RUSTSEC-2026-0309","summary":"`SinglyLinkedList::remove` dereferences a null link","details":"In versions before 0.2.1, `SinglyLinkedList::remove` is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when `node` is not in the list, `(*current_elm).next` reads a null pointer. That is undefined behavior. The list head is a raw `*mut Node\u003cT\u003e`, and safe code can construct the empty list.\n\nThe maintainer fixed this in 0.2.1 by rejecting those two cases with an unconditional `assert!` before the pointer is followed, matching the upstream Zig `unwrap` on the same paths. 0.2.0 was yanked. Versions 0.1.0 through 0.1.13 are still published and still contain the unchecked walk.","modified":"2026-09-25T18:00:04.471289722Z","published":"2026-09-20T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/bun_collections"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0309.html"},{"type":"REPORT","url":"https://github.com/putao520/bao/issues/46"}],"affected":[{"package":{"name":"bun_collections","ecosystem":"crates.io","purl":"pkg:cargo/bun_collections"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.1"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":["bun_collections::pool::SinglyLinkedList::remove"]},"affected_functions":null},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0309.json"}}],"schema_version":"1.9.0"}