CVE-2026-6654

MEDIUM 5.1CVE-2026-6654 · Published 20/04/2026 · updated 26/10/2026

In short

CVE-2026-6654 is a MEDIUM (CVSS 5.1) vulnerability affecting thin-vec (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.17%, higher than 6.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
thin-vec mozilla	`= 0.2.15`	No fix yet

Description

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

References

mozilla/thin-vec security advisory · Exploit
access.redhat.com/security/cve/CVE-2026-6654
bugzilla.redhat.com/show_bug.cgi
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6654.json

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free