RUSTSEC-2025-0047: Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

[github-actions]

Out-of-bounds access in get_disjoint_mut due to incorrect bounds check

Details
Package	slab
Version	0.4.10
URL	GHSA-qx2v-8332-m4fv
Date	2025-08-12
Patched versions	>=0.4.11
Unaffected versions	<0.4.10

Impact

The get_disjoint_mut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.

Patches

This has been fixed in slab v0.4.11.

Workarounds

Avoid using get_disjoint_mut with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.

References

• Fix get_disjoint_mut error condition tokio-rs/slab#152

See advisory page for additional details.