CVE-2024-27284: cassandra-rs non-idiomatic use of iterators leads to use after free

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-29 · updated 2026-06-17
Weakness: CWE-416

Description

cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0.

Affected products

Metaswitch cassandra-rs: before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: Metaswitch cassandra-rs 3.0.0. Check the vendor advisory for mitigations.

References

https://github.com/Metaswitch/cassandra-rs/commit/ae054dc8044eac9c2c7ae2b1ab154b53ca7f8df7
https://github.com/Metaswitch/cassandra-rs/security/advisories/GHSA-x9xc-63hg-vcfq
https://github.com/Metaswitch/cassandra-rs/commit/ae054dc8044eac9c2c7ae2b1ab154b53ca7f8df7
https://github.com/Metaswitch/cassandra-rs/security/advisories/GHSA-x9xc-63hg-vcfq

Get alerted when CVE-2024-27284 or the next vulnerability affects your stack