[MJUCOM]

Affected crate(s)

caja (~5.5k total downloads on crates.io) — all versions before 0.3.2

Links to upstream issue(s) or PR(s)

• Upstream issue: Unsoundness: as_mut_slice(&self) lets safe code create aliasing &mut [T] EmanuelGCC/Caja#3
• Fix commit: 40833c4
• Fix release: 0.3.2 (2026-11-02)

Severity

Caja::as_mut_slice() takes &self but returns &mut [T] over the whole array.
Since any number of shared borrows of a Caja can exist, calling it twice gives two
live mutable slices of the same elements, which breaks Rust's aliasing rules. A write
through one slice is visible through the other, and Miri reports the access as
undefined behavior.

Filed as a soundness issue: no unsafe is required from the caller, and the effect
is aliasing &mut references (undefined behavior), not a demonstrated memory
corruption.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

At 42 recent downloads (the pull request template asked for recent downloads, not all-time downloads), this crate doesn't meet our notability criteria:

#wg-secure-code > Minimum notability criteria?