RUSTSEC-2026-0302 json
`stack-graphs` C API exports are safe `extern "C"` functions
published last mo. modified last mo.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
`stack_graphs::c` is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are `pub extern "C" fn` rather than `unsafe fn`. Safe Rust can call them.
`sg_stack_graph_free` frees the pointer with `Box::from_raw`. `sg_stack_graph_free(std::ptr::null_mut())` is immediate undefined behavior. The same shape is used by the other `*_free` exports and by getters and mutators that dereference the caller-supplied pointer or pass it to `from_raw_parts` (`sg_stack_graph_nodes`, `sg_stack_graph_add_edges`, and the rest of the pointer-taking functions in `src/c.rs`). Constructors that take no pointer are not part of this issue.
The upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export `unsafe extern "C" fn`, with a safety comment that the pointer is non-null and, for `free`, came from the matching constructor.
Is RUSTSEC-2026-0302 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | stack-graphs | >=0.0.3-0 |
no fix listed |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.