downcast_mut unsoundness advisory for anyhow

[dfoxfranke]

The same unsoundness bug occurs in three popular error-handling crates. The unsound code originally appeared in anyhow. eyre copied it, and then miette copied it from eyre. This PR originally contained advisories for all three crates, and then was split to contain just anyhow. I'll continue to use this thread to track progress on the other two crates.

Affected crate(s)

• anyhow (163,113,997)
• eyre (16,375,087)
• miette (12,898,466)

Links to upstream issue(s) or PR(s)

• anyhow: Issue, PR
• eyre: Issue, PR
• miette: Issue

Severity

Informational advisory for soundness issues in safe public APIs. Advisories include example code that crashes in MIRI, but in my limited testing I was unable to find any evidence that rustc currently exploits the UB or compiles the code according to other than its author-intended semantics.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate - see timeline

Communication timeline

• 2026-05-31: @Shnatsel reported the issue to miette.
• 2026-06-25: I reported the issue to anyhow. Fixed released on the same day by @dtolnay and okayed a RustSec advisory.
• 2026-06-26: I reported the issue to eyre and opened a PR with a fix.
• 2026-06-29: eyre fix merged to master.

I'm currently checking with eyre maintainers on release timelines. I'm not sure of miette's intentions, since there has been no maintainer response to the issue thread, but we're past two weeks from public disclosure.

[djc]

Thanks for reporting this. Happy to merge and publish an advisory for anyhow (maybe split these into separate PRs?). For eyre, can you get confirmation from a maintainer that publishing an advisory is okay? For miette, I'd prefer to hold off for a bit to get a response.

[dfoxfranke]

Okay, I've updated this PR to contain just the anyhow advisory. I'll open separate drafts for the other two. This one should be ready to merge.

[djc]

Thanks!