{"action":"Upgrade bumpalo to 3.11.1 or later.","affected":[{"fixed":"3.11.1","introduced":"1.1.0"}],"component":"bumpalo","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["3.11.1"],"ghsa_id":"GHSA-f85w-wvc7-crwc","id":"tcs_01M5KEX97XJEKTKDE8J1C4R97M","modified_at":"2026-09-10T03:49:51.242906965Z","published_at":"2023-01-20T21:54:22Z","references":["https://osv.dev/vulnerability/GHSA-f85w-wvc7-crwc","https://github.com/fitzgen/bumpalo","https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md#3111","https://rustsec.org/advisories/RUSTSEC-2022-0078.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f85w-wvc7-crwc","url":"https://osv.dev/vulnerability/GHSA-f85w-wvc7-crwc"}],"summary":"bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`"}