{"id":"GHSA-mr2v-63pc-gmr4","aliases":["RUSTSEC-2026-0267"],"status":"published","title":"Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)","description":"`BitVecCore::clear` drops every occupied element with `drop_in_place` and only\nafterwards clears the occupancy bits and resets `len`. If an element's `Drop`\npanics, those metadata updates are skipped, so the slot of the already-dropped\nelement stays marked as occupied. `BitVecCore::drop` calls `clear()` again,\nvisits the same slot, and drops the element a second time — a double-free /\nuse-after-free reachable from safe Rust.\n\nReachable via the public `StableVec::clear` and `ExternStableVec::clear`, which\ndelegate to `BitVecCore::clear`.\n\n## Impact\n\n* CWE-415 (Double Free): the same allocation is freed twice.\n* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.\n\nReachable entirely from safe Rust via `catch_unwind` with element types whose\n`Drop` can panic. Confirmed under AddressSanitizer on 0.4.2.\n\n## Fix\n\nFixed in `stable-vec` 0.4.3 by removing each element via `remove_at`, which\nclears the occupancy bit before taking the value out.\n\nRelease 0.4.3 also fixes several other panic-safety issues found by the\nmaintainer; see [GHSA-mr2v-63pc-gmr4](https://github.com/LukasKalbertodt/stable-vec/security/advisories/GHSA-mr2v-63pc-gmr4)\nand the 0.4.3 changelog for the full list.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-24T12:00:00Z","modified":"2026-08-25T02:45:03Z","fixes":[{"ecosystem":"crates.io","package":"stable-vec","fixed_in":["0.4.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"stable-vec","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.3"}]}]}],"references":[{"url":"https://crates.io/crates/stable-vec","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0267.html","tags":["advisory"]},{"url":"https://github.com/LukasKalbertodt/stable-vec/pull/51","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0267","title":"Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)","description":"`BitVecCore::clear` drops every occupied element with `drop_in_place` and only\nafterwards clears the occupancy bits and resets `len`. If an element's `Drop`\npanics, those metadata updates are skipped, so the slot of the already-dropped\nelement stays marked as occupied. `BitVecCore::drop` calls `clear()` again,\nvisits the same slot, and drops the element a second time — a double-free /\nuse-after-free reachable from safe Rust.\n\nReachable via the public `StableVec::clear` and `ExternStableVec::clear`, which\ndelegate to `BitVecCore::clear`.\n\n## Impact\n\n* CWE-415 (Double Free): the same allocation is freed twice.\n* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.\n\nReachable entirely from safe Rust via `catch_unwind` with element types whose\n`Drop` can panic. Confirmed under AddressSanitizer on 0.4.2.\n\n## Fix\n\nFixed in `stable-vec` 0.4.3 by removing each element via `remove_at`, which\nclears the occupancy bit before taking the value out.\n\nRelease 0.4.3 also fixes several other panic-safety issues found by the\nmaintainer; see [GHSA-mr2v-63pc-gmr4](https://github.com/LukasKalbertodt/stable-vec/security/advisories/GHSA-mr2v-63pc-gmr4)\nand the 0.4.3 changelog for the full list.","status":"published","published":"2026-08-24T12:00:00Z","modified":"2026-08-25T02:45:03.396225962Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}