CVE-2026-6654
Use-After-Free and Double-Free in IntoIter::drop when element drop panics
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
| Vendor | mozilla |
| Product | thin-vec |
| Ecosystems | |
| Industries | Technology |
| Published | Apr 20, 2026 |
| Last Updated | Apr 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for mozilla thin-vec
Be the first to know when new unknown vulnerabilities affecting mozilla thin-vec are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mozilla / thin-vec
All versions affected References
Credits
Juhyung Son