RUSTSEC-2026-0301None▾ SunlitDouble free in `StackVec::retain` when a predicate or element `Drop` panics
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
StackVec::retain committed its new length to self.len only after
its internal loop completed. If the retain predicate or a removed
element's Drop implementation panicked before the loop finished,
unwinding proceeded with self.len still equal to the original,
pre-retain length, leaving either a duplicated or already-destroyed
element inside 0..len. StackVec's own Drop then revisited that
slot, causing a double-drop (and for heap-owning types, a double-free).
Affects StackVec<T, CAP>::retain for T: Drop types where the
predicate or the removed element's destructor can panic, on builds
with unwinding enabled (panic = "unwind"). no_std/panic = "abort"
builds cannot trigger this, since unwinding never occurs.
Fixed in 0.3.3 using an unwind-safe backshift guard, matching the
approach alloc::vec::Vec::retain uses.
stack_collections >= 0.3.0, < 0.3.3Upgrade to a patched release:
stack_collections 0.3.3