CVE-2026-6654

MediumCVSS 5.1/10Last modified Jul 15, 2026

Description

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-415CWE-416CWE-1341

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-66567.5Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. CVE-2026-665639.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.CVE-2026-665649.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.CVE-2026-665659.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.CVE-2026-665668.1Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-665679.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.CVE-2026-665689.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-665699.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.CVE-2026-66578.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_CVE-2026-665717.1Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-665726.5Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.CVE-2026-665736.5Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
CVE-2026-6654: Medium severity, CVSS 5.1 | Vulnix