CVE-2022-0010: enum-map Macro Uninitialized Type Arbitrary Code Execution
Summary
RUSTSEC-2022-0010: enum_map macro can cause UB when Enum trait is incorrectly implemented. Affects enum-map versions >= 2.0.0-2, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The enum-map crate is a library for creating and manipulating maps with enum keys in Rust. It provides a macro called enum_map! that allows users to create enum maps easily. Enum maps are arrays where each index corresponds to a variant of the enum, and the value at that index is associated with that variant. This vulnerability affects versions of the enum-map crate prior to 2.0.2.
Vulnerability Detail
The vulnerability arises from a lack of proper length checking in the enum_map! macro. When the LENGTH property in the Enum trait does not match the array length in the EnumArray trait, the enum map can be initialized with uninitialized types. This can lead to arbitrary code execution if an attacker can control the uninitialized types. The vulnerability only affects manual implementations of the Enum trait and not enums that use the #[derive(Enum)] attribute.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version of the enum-map crate is the recommended solution.
Conclusion
The enum-map crate prior to version 2.0.2 is vulnerable to arbitrary code execution due to uninitialized types in the enum map. Users should update to version 2.0.2 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for enum-map →
FAQ
Versions prior to 2.0.2 are affected.
Yes, if an attacker can control the uninitialized types in the enum map.
No, this vulnerability only affects manual implementations of the Enum trait.
No, updating to the fixed version of the enum-map crate is the recommended solution.
The vulnerability was fixed in version 2.0.2 of the enum-map crate by adding proper length checking in the enum_map! macro.
References
Related vulnerabilities
Recent vulnerabilities recorded for enum-map.
