RUSTSEC-2021-0049: 
Rust vulnerability analysis and mitigation

A memory-safety vulnerability was discovered in the through crate through version 2021-02-18 for Rust. The vulnerability (RUSTSEC-2021-0049) involves a double free condition that occurs in the through() and through_and() functions when the map function panics (GitHub Issue).

The vulnerability stems from the public functions through::through() and through::through_and() not being panic-safe. Both functions take a user-provided closure as a parameter, and a double free of type T occurs if the user-provided closure panics. The issue was identified with a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability can lead to memory corruption through double free operations, potentially resulting in program crashes or undefined behavior. The issue affects applications using the through crate's through() and through_and() functions when handling panics (GitHub Issue).

The vulnerability can be triggered through safe APIs of the through crate. A proof-of-concept exists demonstrating the issue using a simple program that causes a panic within the closure passed to the through() function (GitHub Issue).

Users should upgrade to a version after 2021-02-18 where the vulnerability has been addressed (NVD).