---
id: RUSTSEC-2026-0301
title: 'Double free in `StackVec::retain` when a predicate or element `Drop` panics'
summary: 'Double free in `StackVec::retain` when a predicate or element `Drop` panics'
severity: none
vendor: stack_collections
product: stack_collections
ecosystem: rust
affected:
  - 'stack_collections >= 0.3.0, < 0.3.3'
patched:
  - stack_collections 0.3.3
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T21:00:02.870917912Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0301'
references:
  - url: 'https://crates.io/crates/stack_collections'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0301.html'
  - url: 'https://github.com/OverwrittenCode/stack_collections/pull/4'
tags:
  - osv
  - rust
ingestedAt: '2026-09-24T07:16:01.871Z'
---

## Overview

## Summary

`StackVec::retain` committed its new length to `self.len` only after
its internal loop completed. If the retain predicate or a removed
element's `Drop` implementation panicked before the loop finished,
unwinding proceeded with `self.len` still equal to the original,
pre-retain length, leaving either a duplicated or already-destroyed
element inside `0..len`. `StackVec`'s own `Drop` then revisited that
slot, causing a double-drop (and for heap-owning types, a double-free).

## Impact

Affects `StackVec<T, CAP>::retain` for `T: Drop` types where the
predicate or the removed element's destructor can panic, on builds
with unwinding enabled (`panic = "unwind"`). `no_std`/`panic = "abort"`
builds cannot trigger this, since unwinding never occurs.

## Patch

Fixed in 0.3.3 using an unwind-safe backshift guard, matching the
approach `alloc::vec::Vec::retain` uses.

## Affected packages

- `stack_collections >= 0.3.0, < 0.3.3`

## Remediation

Upgrade to a patched release:

- `stack_collections 0.3.3`