CVE-2026-6654

A flaw was found in the thin_vec component of mozilla/thin-vec. This vulnerability involves a memory management error known as a Double-Free/Use-After-Free (UAF), which occurs in the IntoIter::drop and ThinVec::clear functions. When a specific error condition (a panic in ptr::drop_in_place) is triggered, the system fails to correctly manage memory, potentially allowing an attacker to execute malicious code or cause the application to crash, leading to a denial of service.

This vulnerability affects version 0.2.15 of thin-vec, which is not included in any Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.