RUSTSEC-2026-0284 Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

Two independent soundness problems, both reachable from safe Rust. Map::intoiter drops builder the caller-supplied hasher H and incin by hand, then commits the ownership transfer with mem::forgetself. H::drop is user code and may panic. If it does, mem::forgetself is skipped and the still-live Ma...

Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

Two independent soundness problems, both reachable from safe Rust. Map::intoiter drops builder the caller-supplied hasher H and incin by hand, then commits the ownership transfer with mem::forgetself. H::drop is user code and may panic. If it does, mem::forgetself is skipped and the still-live Ma...