🦀 Rust’s Oldest Soundness Bug

Issue #25860, the five-line function that turns any reference into a 'static one

An attempt at explaining a hard to read bug.

Rust 1.0 shipped on 15 May 2015. Thirteen days later, on 28 May, someone opened issue #25860 on the compiler’s tracker with the title “Implied bounds on nested references + variance = soundness hole”. It is still open today. It carries the I-unsound label, which the Rust project describes as “the worst kind of bug”, and it is the oldest open hole in the type system itself. The exact repro that first demonstrated it was fixed in Rust 1.83.0, but the hole persists in a variant that still compiles today. In February 2024 it became the engine of cve-rs, a joke crate whose tagline promises “blazingly fast memory vulnerabilities, written in 100% safe Rust”. The joke works because the bug is real.

The repro is tiny, has no unsafe, and reads like nonsense the first time you see it. Every line leans on a rule most Rust programmers never knowingly use, and the bug lives in how those rules meet. The exact form shown below no longer compiles; the variant that still does is nearly identical. This post takes the repro apart one rule at a time, at a pace that assumes you know what a reference and a lifetime are but have never had to think about variance or higher-ranked types.