Repository navigation
RUSTSEC-2026-0202: let_cxx_string! uses uninitialized value due to exception safety violations #3880
Description
let_cxx_string!uses uninitialized value due to exception safety violations
| Details | |
|---|---|
| Status | unsound |
| Package | cxx |
| Version | 1.0.194 |
| URL | dtolnay/cxx#1729 |
| Date | 2026-07-05 |
In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.
The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.
See advisory page for additional details.
Activity