Soundness Issue in array-init-cursor: Double Drop Invocation
Summary
GHSA-67r5-rqwv-9p9q: array-init-cursor is unsound when used with types that implement Drop. Affects array-init-cursor versions < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The array-init-cursor package is a Rust crate designed to facilitate the initialization of arrays with a cursor-based approach. It allows developers to create and manipulate arrays efficiently. However, this package has a critical vulnerability that arises when used with types that implement the Drop trait, leading to potential double invocation of the Drop implementation, which can cause unexpected behavior and resource management issues.
Vulnerability Detail
The vulnerability in array-init-cursor stems from its unsound behavior when handling types that implement the Drop trait. When using the cursor to initialize arrays, the Drop implementation for these types may be executed twice. This can lead to resource leaks, crashes, or other unpredictable behaviors in applications that rely on proper resource management. The issue does not affect types that are Copy, such as u8, nor does it impact users who depend on the package indirectly through the planus crate.
How To Fix
Latest published version: 0.2.1 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider using types that are Copy, such as integers, to avoid the double Drop issue. Alternatively, you can avoid using the cursor functionality with types that implement Drop until the package is updated.
Conclusion
The array-init-cursor package has a vulnerability that can lead to double invocation of the Drop implementation for certain types, causing potential resource management issues. Users are advised to update to version 0.2.1 or later to mitigate this risk. For those unable to update immediately, using Copy types or avoiding the cursor functionality can serve as a temporary workaround.
See every vulnerability recorded for array-init-cursor →
FAQ
The main issue is that it can cause the Drop implementation of certain types to be called twice, leading to potential resource management problems.
Types that implement the Drop trait are affected. Types that are Copy, like u8, are not impacted.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary workaround, use types that are Copy or avoid using the cursor functionality with types that implement Drop.
While the severity is classified as low, it can lead to significant issues in applications that rely on proper resource management.
References
Related vulnerabilities
Recent vulnerabilities recorded for array-init-cursor.
