{"id":4294641,"name":"thin-vec","ecosystem":"cargo","description":"A Vec that takes up less space on the stack.","homepage":null,"licenses":"MIT OR Apache-2.0","normalized_licenses":["MIT","Apache-2.0"],"repository_url":"https://github.com/mozilla/thin-vec","keywords_array":[],"namespace":null,"versions_count":25,"first_release_published_at":"2018-05-15T03:20:47.914Z","latest_release_published_at":"2026-10-07T22:46:15.062Z","latest_release_number":"0.2.21","last_synced_at":"2026-10-12T09:16:18.989Z","created_at":"2022-04-13T06:50:45.354Z","updated_at":"2026-10-13T09:10:00.559Z","registry_url":"https://crates.io/crates/thin-vec/","install_command":"cargo install thin-vec","documentation_url":"https://docs.rs/thin-vec/","metadata":{"categories":[]},"repo_metadata":{"id":38018674,"uuid":"86634615","full_name":"mozilla/thin-vec","owner":"mozilla","description":"A Vec That Has a Smaller size_of","archived":false,"fork":false,"pushed_at":"2026-10-05T20:15:26.000Z","size":158,"stargazers_count":178,"open_issues_count":5,"forks_count":48,"subscribers_count":10,"default_branch":"main","last_synced_at":"2026-10-06T06:57:30.856Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mozilla.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2017-03-29T22:20:14.000Z","updated_at":"2026-10-05T20:15:31.000Z","dependencies_parsed_at":"2026-09-17T23:37:05.129Z","dependency_job_id":null,"html_url":"https://github.com/mozilla/thin-vec","commit_stats":{"total_commits":119,"total_committers":19,"mean_commits":"6.2631578947368425","dds":0.5378151260504201,"last_synced_commit":"60db5977dbe96a5271939b02c9376ea3310b97a1"},"previous_names":["gankro/thin-vec","mozilla/thin-vec","gankra/thin-vec"],"tags_count":14,"template":false,"template_full_name":null,"purl":"pkg:github/mozilla/thin-vec","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozilla","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/sbom","scorecard":{"id":54743,"data":{"date":"2025-08-11","repo":{"name":"github.com/Gankra/thin-vec","commit":"ce8808956191d55fe5a8aedcefc7ca3a94ddea11"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.8,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":4,"reason":"Found 8/18 approved changesets -- score normalized to 4","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rust.yml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rust.yml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/Gankra/thin-vec/rust.yml/main?enable=pin","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   7 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/rust.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE-APACHE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE-APACHE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 24 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-15T00:28:03.348Z","repository_id":38018674,"created_at":"2025-08-15T00:28:03.348Z","updated_at":"2025-08-15T00:28:03.348Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343170754,"owners_count":38081432,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-06T02:00:06.537Z","response_time":86,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"mozilla","name":"Mozilla","uuid":"131524","kind":"organization","description":"This technology could fall into the right hands.","email":null,"website":"https://wiki.mozilla.org/Github","location":"Mountain View, California","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/131524?v=4","repositories_count":2423,"last_synced_at":"2024-10-30T01:45:08.365Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/mozilla","funding_links":[],"total_stars":283529,"followers":8105,"following":0,"created_at":"2022-11-02T16:20:09.610Z","updated_at":"2024-10-30T01:45:08.366Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozilla","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozilla/repositories"},"tags":[{"name":"v0.2.20","sha":"79452c2f5948dd924b84a7ecf8a1a3b74929632a","kind":"tag","published_at":"2026-09-16T14:53:07.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.20","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.20","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.20","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.20","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.20/manifests"},{"name":"v0.2.19","sha":"5c0c9f5699d2f9620524d46a8a11a346226b330e","kind":"tag","published_at":"2026-07-26T12:35:04.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.19","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.19/manifests"},{"name":"v0.2.18","sha":"6db6b4eaa4e8758543bca112d2a1f3e26dfc37aa","kind":"tag","published_at":"2026-07-26T12:31:57.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.18","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.18/manifests"},{"name":"v0.2.17","sha":"bed87e3798b19a23ccf84630279cd984f02d9623","kind":"tag","published_at":"2026-07-26T12:31:44.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.17","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.17/manifests"},{"name":"v0.2.16","sha":"3c96f1e335e695e6f6d43a3d383a9ea9f1f9d586","kind":"tag","published_at":"2026-04-14T12:05:01.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.16","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.16/manifests"},{"name":"v0.2.15","sha":"70bcca0960a7e11056fa3281445d08052421dab5","kind":"tag","published_at":"2026-04-08T18:08:59.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.15","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.15/manifests"},{"name":"v0.2.14","sha":"16163cbc3cc43fe9879a4e9500ebd6d42ddc623d","kind":"tag","published_at":"2026-04-08T18:04:32.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.14","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.14/manifests"},{"name":"v0.2.13","sha":"60db5977dbe96a5271939b02c9376ea3310b97a1","kind":"tag","published_at":"2023-12-03T03:16:00.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.13","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.13/manifests"},{"name":"v0.2.12","sha":"a0149557282ee78a535d93daaa647668a585569e","kind":"tag","published_at":"2023-02-20T01:15:35.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.12","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.12/manifests"},{"name":"v0.2.11","sha":"bdbee2bce5d9d884b2886104b341828127449af0","kind":"tag","published_at":"2023-02-19T20:02:59.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.11","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.11/manifests"},{"name":"v0.2.10","sha":"65c930852b1848a8159c86e2e54734c6b0881edf","kind":"tag","published_at":"2022-12-05T22:53:13.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.10","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.10/manifests"},{"name":"v0.2.9","sha":"af8595c12ec25a4a49c5a527119eb046dbe4efa9","kind":"tag","published_at":"2022-11-02T20:53:28.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.9","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.9/manifests"},{"name":"v0.2.7","sha":"008ebb730509060fa92d4e6c2d548ad547874179","kind":"commit","published_at":"2022-08-19T13:37:00.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.7","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.7/manifests"},{"name":"v0.2.6","sha":"d2d52bbe04c3bfa4fa62a7621598fe93413786ba","kind":"commit","published_at":"2022-08-18T01:04:32.000Z","download_url":"https://codeload.github.com/mozilla/thin-vec/tar.gz/v0.2.6","html_url":"https://github.com/mozilla/thin-vec/releases/tag/v0.2.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/mozilla/thin-vec@v0.2.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/tags/v0.2.6/manifests"}]},"repo_metadata_updated_at":"2026-10-12T09:16:09.398Z","dependent_packages_count":19,"downloads":38690916,"downloads_period":"total","dependent_repos_count":187,"rankings":{"downloads":2.7269772566925887,"dependent_repos_count":2.515319428920228,"dependent_packages_count":4.671837330288034,"stargazers_count":13.660253513757759,"forks_count":11.661791402094382,"docker_downloads_count":0.6563770838783324,"average":5.9820926692718865},"purl":"pkg:cargo/thin-vec","advisories":[{"uuid":"GSA_kwCzR0hTQS14cGh3LWNxeDMtNjY3as4ABVVf","url":"https://github.com/advisories/GHSA-xphw-cqx3-667j","title":"thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics","description":"### Summary\n\nA **Double Free / Use-After-Free (UAF)** vulnerability has been identified in the `IntoIter::drop` and `ThinVec::clear` implementations of the `thin_vec` crate.\nBoth vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no `unsafe` blocks required.\nUndefined Behavior has been confirmed via **Miri** and **AddressSanitizer (ASAN)**.\n\n---\n\n### Details\n\nBoth vulnerabilities share the same root cause. When a **panic occurs** during sequential element deallocation, the subsequent length cleanup code (`set_len(0)`) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).\n\n#### Vulnerability 1 — `IntoIter::drop`\n\n**Location:** `thin-vec/src/lib.rs` L.2308~2314\n\n`IntoIter::drop` transfers ownership of the internal buffer via `mem::replace`, then sequentially frees elements via `ptr::drop_in_place`.\nIf a panic occurs during element deallocation, `set_len_non_singleton(0)` is never reached. During unwinding, `vec` is dropped again, re-freeing already-freed elements.\nThe standard library's `std::vec::IntoIter` prevents this with a **DropGuard pattern**, but thin-vec lacks this defense.\n\n```rust\n// Problematic structure (conceptual representation)\nimpl\u003cT\u003e Drop for IntoIter\u003cT\u003e {\n    fn drop(\u0026mut self) {\n        let mut vec = mem::replace(\u0026mut self.vec, ThinVec::new());\n        unsafe {\n            ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here\n            vec.set_len_non_singleton(0);                  // ← unreachable on panic\n        }\n        // During unwinding, vec is dropped again → Double Free\n    }\n}\n```\n\n#### Vulnerability 2 — `ThinVec::clear`\n\n`clear()` calls `ptr::drop_in_place(\u0026mut self[..])` followed by `self.set_len(0)` to reset the length.\nIf a panic occurs during element deallocation, `set_len(0)` is never executed. When the `ThinVec` itself is subsequently dropped, already-freed elements are freed again.\n\n```rust\n// Problematic structure (conceptual representation)\npub fn clear(\u0026mut self) {\n    unsafe {\n        ptr::drop_in_place(\u0026mut self[..]); // ← panic may occur here\n        self.set_len(0);                   // ← unreachable on panic\n    }\n    // ThinVec drop later → Double Free\n}\n```\n\n#### Recommended Fix\n\nBoth vulnerabilities can be resolved with the same pattern:\n\n- **DropGuard pattern:** Insert an RAII guard before `drop_in_place` to guarantee `set_len(0)` is called regardless of panic\n- **Pre-zeroing approach:** Set the length to 0 before calling `drop_in_place`\n\n---\n\n### PoC\n\n**Requirements:** Rust nightly toolchain, `thin-vec = \"0.2.14\"`\n\n```bash\n# Miri\ncargo +nightly miri run\n\n# ASAN\nRUSTFLAGS=\"-Z sanitizer=address\" cargo +nightly run --release\n```\n\n#### PoC-1: `IntoIter::drop`\n\n```rust\nuse thin_vec::ThinVec;\n\nstruct PanicBomb(String);\n\nimpl Drop for PanicBomb {\n    fn drop(\u0026mut self) {\n        if self.0 == \"panic\" {\n            panic!(\"panic!\");\n        }\n        println!(\"Dropping: {}\", self.0);\n    }\n}\n\nfn main() {\n    let mut v = ThinVec::new();\n    v.push(PanicBomb(String::from(\"normal1\")));\n    v.push(PanicBomb(String::from(\"panic\")));  // trigger element\n    v.push(PanicBomb(String::from(\"normal2\")));\n\n    let mut iter = v.into_iter();\n    iter.next();\n    // When iter is dropped: panic occurs at \"panic\" element\n    // → During unwinding, Double Drop is triggered on \"normal1\" (already freed)\n}\n```\n\n**Miri output:**\n```\nerror: Undefined Behavior: pointer not dereferenceable:\n       alloc227 has been freed, so this pointer is dangling\n\nstack backtrace:\n   3: \u003cPanicBomb as Drop\u003e::drop           ← Double Drop entry\n   6: \u003cThinVec\u003cT\u003e as Drop\u003e::drop::drop_non_singleton\n   9: \u003cIntoIter\u003cT\u003e as Drop\u003e::drop::drop_non_singleton  ← lib.rs:2310 (root cause)\n```\n\n**ASAN output:**\n```\n==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010\nREAD of size 7 at 0x7afa685e0010\n    #0 memcpy\n    #4 drop_in_place::\u003cPanicBomb\u003e        ← Double Drop entry point\n    #5 \u003cThinVec as Drop\u003e::drop::drop_non_singleton\n    #6 \u003cIntoIter as Drop\u003e::drop::drop_non_singleton\n```\n\n#### PoC-2: `ThinVec::clear`\n\n```rust\nuse thin_vec::ThinVec;\nuse std::panic;\n\nstruct Poison(Box\u003cusize\u003e, \u0026'static str);\n\nimpl Drop for Poison {\n    fn drop(\u0026mut self) {\n        if self.1 == \"panic\" {\n            panic!(\"panic!\");\n        }\n        println!(\"Dropping: {}\", self.0);\n    }\n}\n\nfn main() {\n    let mut v = ThinVec::new();\n    v.push(Poison(Box::new(1), \"normal1\")); // index 0\n    v.push(Poison(Box::new(2), \"panic\"));   // index 1 → panic triggered here\n    v.push(Poison(Box::new(3), \"normal2\")); // index 2\n\n    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {\n        v.clear();\n        // panic occurs at \"panic\" element during clear()\n        // → set_len(0) is never called\n        // → already-freed elements are re-freed when v goes out of scope\n    }));\n}\n```\n\n---\n\n### Impact\n\n**Vulnerability classification:**\n- CWE-415: Double Free\n- CWE-416: Use-After-Free\n\n**Affected code:** All code satisfying the following conditions simultaneously:\n\n1. `ThinVec` stores heap-owning types (`String`, `Vec`, `Box`, etc.)\n2. (Vulnerability 1) An iterator is created via `into_iter()` and dropped before being fully consumed, or\n   (Vulnerability 2) `clear()` is called while a remaining element's `Drop` implementation can panic\n3. The `Drop` implementation of a remaining element triggers a panic\n\nAdditionally, when combined with `Box\u003cdyn Trait\u003e` types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-15T19:24:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","references":["https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j","https://nvd.nist.gov/vuln/detail/CVE-2026-6654","https://rustsec.org/advisories/RUSTSEC-2026-0103.html","https://github.com/advisories/GHSA-xphw-cqx3-667j"],"source_kind":"github","identifiers":["GHSA-xphw-cqx3-667j","CVE-2026-6654"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-15T20:00:09.551Z","updated_at":"2026-10-12T12:05:29.910Z","epss_percentage":0.00161,"epss_percentile":0.04551,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cGh3LWNxeDMtNjY3as4ABVVf","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cGh3LWNxeDMtNjY3as4ABVVf","packages":[{"ecosystem":"cargo","package_name":"thin-vec","versions":[{"first_patched_version":"0.2.16","vulnerable_version_range":"\u003c 0.2.16"}],"purl":"pkg:cargo/thin-vec"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cGh3LWNxeDMtNjY3as4ABVVf/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/cargo/thin-vec","docker_dependents_count":138,"docker_downloads_count":30758363,"usage_url":"https://repos.ecosyste.ms/usage/cargo/thin-vec","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/cargo/thin-vec/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-09T09:16:06.273Z","issues_count":4,"pull_requests_count":21,"avg_time_to_close_issue":7253984.666666667,"avg_time_to_close_pull_request":2016938.388888889,"issues_closed_count":3,"pull_requests_closed_count":18,"pull_request_authors_count":11,"issue_authors_count":4,"avg_comments_per_issue":1.0,"avg_comments_per_pull_request":1.380952380952381,"merged_pull_requests_count":17,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":3,"past_year_pull_requests_count":19,"past_year_avg_time_to_close_issue":7253984.666666667,"past_year_avg_time_to_close_pull_request":1073926.3529411764,"past_year_issues_closed_count":3,"past_year_pull_requests_closed_count":17,"past_year_pull_request_authors_count":10,"past_year_issue_authors_count":3,"past_year_avg_comments_per_issue":1.3333333333333333,"past_year_avg_comments_per_pull_request":1.5263157894736843,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":16,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Fthin-vec/issues","maintainers":[{"login":"emilio","count":7,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/emilio"}],"active_maintainers":[{"login":"emilio","count":7,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/emilio"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/thin-vec/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/thin-vec/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/thin-vec/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/thin-vec/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/thin-vec/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/thin-vec/codemeta","maintainers":[{"uuid":"38","login":"Gankra","name":"Aria Desires","email":null,"url":"https://github.com/Gankra","packages_count":52,"html_url":"https://crates.io/users/Gankra","role":null,"created_at":"2022-11-08T02:24:27.207Z","updated_at":"2022-11-08T02:24:27.207Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/Gankra/packages"},{"uuid":"3788","login":"emilio","name":"Emilio Cobos Álvarez","email":null,"url":"https://github.com/emilio","packages_count":19,"html_url":"https://crates.io/users/emilio","role":null,"created_at":"2025-09-21T10:28:08.117Z","updated_at":"2025-09-21T10:28:08.117Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/emilio/packages"},{"uuid":"168409","login":"nicoburns","name":"Nico Burns","email":null,"url":"https://github.com/nicoburns","packages_count":62,"html_url":"https://crates.io/users/nicoburns","role":null,"created_at":"2025-02-28T16:11:44.485Z","updated_at":"2025-02-28T16:11:44.485Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/nicoburns/packages"}]}