Use-after-free from a comparator that answers inconsistently

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory CWE-416. A safe impl Ord with the default comparator is enough to rea...

Aliasing violations in splice, mutable iteration and cursors

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models CWE-758. All four are reachable from safe code with standard Ord types. 1. Splice back-pointer...

RUSTSEC-2026-0409 Use-after-free from a comparator that answers inconsistently

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory CWE-416. A safe impl Ord with the default comparator is enough to rea...

PT-2026-125068

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory CWE-416. A safe impl Ord with the default comparator is enough to rea...

PT-2026-125067

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models CWE-758. All four are reachable from safe code with standard Ord types. 1. Splice back-pointer. split...