Critical Memory Corruption Vulnerability in bun_collections: Unchecked Dereference in SinglyLinkedList::remove
Summary
RUSTSEC-2026-0309: SinglyLinkedList::remove dereferences a null link. Affects bun_collections versions >= 0.0.0-0, < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The bun_collections package is a Rust library that provides various data structures, including an intrusive singly linked list. This package is designed for performance and flexibility, allowing developers to manage collections of data efficiently. However, it has been identified that versions prior to 0.2.1 contain a significant vulnerability in the SinglyLinkedList::remove function, which can lead to undefined behavior due to unchecked dereferencing of null pointers.
Vulnerability Detail
In versions before 0.2.1, the SinglyLinkedList::remove function does not properly handle cases where the list is empty or the specified node is not part of the list. This oversight results in dereferencing a null pointer when attempting to access the next element in the list, leading to undefined behavior. Such vulnerabilities can cause memory corruption, crashes, or potential exploitation by attackers, making it critical for developers to address this issue promptly.
How To Fix
Minimum fixed version
0.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, ensure that you do not call the remove function on an empty list or on nodes that are not part of the list. Implement checks before calling remove to prevent dereferencing null pointers. For example:
if let Some(node) = list.get_node(node_id) {
list.remove(node);
} else {
// Handle the case where the node is not found
}
Conclusion
The bun_collections package has a critical vulnerability in its SinglyLinkedList::remove function, which can lead to undefined behavior due to unchecked dereferencing. It is essential for developers to update to version 0.2.1 or later to mitigate this risk. Implementing proper checks can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for bun_collections →
FAQ
The vulnerability involves an unchecked dereference in the SinglyLinkedList::remove function, which can lead to undefined behavior when the list is empty or the node is not present.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include memory corruption, application crashes, and potential exploitation by malicious actors, which can compromise the integrity of your application.
Yes, you can implement checks to ensure that you do not call the remove function on an empty list or on nodes that are not part of the list.
Versions from 0.0.0 to 0.2.0 are affected. The vulnerability was fixed in version 0.2.1.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
