{"id":"RUSTSEC-2026-0301","title":"Double free in `StackVec::retain` when a predicate or element `Drop` panics","summary":"Double free in `StackVec::retain` when a predicate or element `Drop` panics","severity":"none","vendor":"stack_collections","product":"stack_collections","ecosystem":"rust","affected":["stack_collections >= 0.3.0, < 0.3.3"],"patched":["stack_collections 0.3.3"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T21:00:02.870917912Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0301","references":[{"url":"https://crates.io/crates/stack_collections"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0301.html"},{"url":"https://github.com/OverwrittenCode/stack_collections/pull/4"}],"tags":["osv","rust"],"ingestedAt":"2026-09-24T07:16:01.871Z","slug":"RUSTSEC-2026-0301","body":"## Overview\n\n## Summary\n\n`StackVec::retain` committed its new length to `self.len` only after\nits internal loop completed. If the retain predicate or a removed\nelement's `Drop` implementation panicked before the loop finished,\nunwinding proceeded with `self.len` still equal to the original,\npre-retain length, leaving either a duplicated or already-destroyed\nelement inside `0..len`. `StackVec`'s own `Drop` then revisited that\nslot, causing a double-drop (and for heap-owning types, a double-free).\n\n## Impact\n\nAffects `StackVec<T, CAP>::retain` for `T: Drop` types where the\npredicate or the removed element's destructor can panic, on builds\nwith unwinding enabled (`panic = \"unwind\"`). `no_std`/`panic = \"abort\"`\nbuilds cannot trigger this, since unwinding never occurs.\n\n## Patch\n\nFixed in 0.3.3 using an unwind-safe backshift guard, matching the\napproach `alloc::vec::Vec::retain` uses.\n\n## Affected packages\n\n- `stack_collections >= 0.3.0, < 0.3.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stack_collections 0.3.3`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}