{"id":"RUSTSEC-2025-0166","aliases":[],"status":"published","title":"Multiple soundness issues in `stackvector`","description":"Affected versions of `stackvector` contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.\n\nOne issue was that `StackVec::length` was exposed as a public field. Safe Rust code could set `length` to a value larger than the backing array capacity. Other safe methods, including `remove`, `pop`, and `truncate`, relied on `length` before performing unsafe pointer operations (`ptr::read`, `ptr::copy`, `offset`/`add`). If `length` was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.\n\nThe upstream maintainer also identified additional soundness issues, including the use of `mem::uninitialized` in `StackVec::from_vec_unchecked`, which was reachable through `from_vec`, and Miri violations related to `MaybeUninit` usage.\n\nVersion `2.0.0` was released to fix the known soundness issues.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-10-23T12:00:00Z","modified":"2026-07-02T08:00:03Z","fixes":[{"ecosystem":"crates.io","package":"stackvector","fixed_in":["2.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"stackvector","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.0.0"}]}]}],"references":[{"url":"https://crates.io/crates/stackvector","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0166.html","tags":["advisory"]},{"url":"https://github.com/Alexhuszagh/rust-stackvector/issues/3","tags":["report"]},{"url":"https://github.com/Alexhuszagh/rust-stackvector/pull/6","tags":["web"]},{"url":"https://github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357","tags":["web"]},{"url":"https://github.com/Alexhuszagh/rust-stackvector/issues/5","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2025-0166","title":"Multiple soundness issues in `stackvector`","description":"Affected versions of `stackvector` contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.\n\nOne issue was that `StackVec::length` was exposed as a public field. Safe Rust code could set `length` to a value larger than the backing array capacity. Other safe methods, including `remove`, `pop`, and `truncate`, relied on `length` before performing unsafe pointer operations (`ptr::read`, `ptr::copy`, `offset`/`add`). If `length` was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.\n\nThe upstream maintainer also identified additional soundness issues, including the use of `mem::uninitialized` in `StackVec::from_vec_unchecked`, which was reachable through `from_vec`, and Miri violations related to `MaybeUninit` usage.\n\nVersion `2.0.0` was released to fix the known soundness issues.","status":"published","published":"2025-10-23T12:00:00Z","modified":"2026-07-02T08:00:03.852602681Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}