RUSTSEC-2026-0528: UB can be reached from safe code
The variance of RefSwap and OptionRefSwap were incorrect, possibly allowing use-after-free.
OptionRefSwap::intoinner did not check for null.
The fix is to make RefSwap and OptionRefSwap invariant, and to change OptionRefSwap::intoinner to return an option. It is available in version 0.1.3. If your project still compiles with 0.1.3 then it is not affected by the unsoundness on version 0.1.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/ref-swapto a version that resolves this vulnerability.Fixed in 0.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.1.3
Event History
Frequently Asked Questions
Which versions should be reviewed?
Version 0.1.2 is affected. The fix is available in version 0.1.3.
How can I tell whether upgrading resolves the unsoundness for my project?
If the project still compiles with ref-swap 0.1.3, it is not affected by the unsoundness present in version 0.1.2.