Rust soundness hole: struct lifetime requirements bypassable since Rust 1.4
jedisct1 · x · 2026-10-13
Security researcher jedisct1 surfaced a high-priority issue (#164250) on the Rust repo: struct lifetime requirements can be bypassed via covariant field assignment, and the problem has existed since Rust 1.4.
The PoC uses a custom Drop impl to stash a reference into a global Mutex<Vec<Box<dyn Any>>> after its lifetime has ended, producing a dangling reference — a classic use-after-free. The issue is labeled I-unsound (the worst class of bug), touching the borrow checker, lifetimes, variance and destructors, and is assigned to the types team.
More from coding & agent
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23