RUSTSEC-2026-0301
Double free in `StackVec::retain` when a predicate or element `Drop` panics
Summary
StackVec::retain committed its new length to self.len only after
its internal loop completed. If the retain predicate or a removed
element's Drop implementation panicked before the loop finished,
unwinding proceeded with self.len still equal to the original,
pre-retain length, leaving either a duplicated or already-destroyed
element inside 0..len. StackVec's own Drop then revisited that
slot, causing a double-drop (and for heap-owning types, a double-free).
Impact
Affects StackVec<T, CAP>::retain for T: Drop types where the
predicate or the removed element's destructor can panic, on builds
with unwinding enabled (panic = "unwind"). no_std/panic = "abort"
builds cannot trigger this, since unwinding never occurs.
Patch
Fixed in 0.3.3 using an unwind-safe backshift guard, matching the
approach alloc::vec::Vec::retain uses.
What each source reports
OSVNo score
Double free in `StackVec::retain` when a predicate or element `Drop` panics
Summary
StackVec::retain committed its new length to self.len only after
its internal loop completed. If the retain predicate or a removed
element's Drop implementation panicked before the loop finished,
unwinding proceeded with self.len still equal to the original,
pre-retain length, leaving either a duplicated or already-destroyed
element inside 0..len. StackVec's own Drop then revisited that
slot, causing a double-drop (and for heap-owning types, a double-free).
Impact
Affects StackVec<T, CAP>::retain for T: Drop types where the
predicate or the removed element's destructor can panic, on builds
with unwinding enabled (panic = "unwind"). no_std/panic = "abort"
builds cannot trigger this, since unwinding never occurs.
Patch
Fixed in 0.3.3 using an unwind-safe backshift guard, matching the
approach alloc::vec::Vec::retain uses.
- Record
RUSTSEC-2026-0301- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
stack_collectionscrates.io | 0.3.0 up to 0.3.3 | 0.3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0301 is a vulnerability with no CVSS score yet in stack_collections, published September 22, 2026. No source lists public exploit code. Fixed in stack_collections 0.3.3.