ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6654

Double-Free / Use-After-Free (UAF) in the and functions in the thin_vec crate.

Published Apr 20, 2026 · updated Jul 15, 2026 · mozilla thin-vec

Double-Free / Use-After-Free (UAF) in the and functions in the thin_vec crate. A panic in skips setting the length to zero.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 20, 2026 · NIST NVD

    Detected

    Double-Free / Use-After-Free (UAF) in the and functions in the thin_vec crate. A panic in skips setting the length to zero.

  2. Jul 15, 2026 · NIST NVD

    Updated

    Double-Free / Use-After-Free (UAF) in the and functions in the thin_vec crate. A panic in skips setting the length to zero.

Affected

  • cpe mozilla/thin-vec0.2.15

Sources

  • CVE.orgVulnerability recordCVE-2026-6654

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-6654

    Double-Free / Use-After-Free (UAF) in the and functions in the thin_vec crate. A panic in skips setting the length to zero.

    nvd.nist.gov

References