RUSTSEC-2026-0267

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0267

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0267.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0267

Aliases

GHSA-mr2v-63pc-gmr4

Published

2026-08-24T12:00:00Z

Modified

2026-08-25T02:45:03.396225962Z

Summary

Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

Details

BitVecCore::clear drops every occupied element with drop_in_place and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop calls clear() again, visits the same slot, and drops the element a second time — a double-free / use-after-free reachable from safe Rust.

Reachable via the public StableVec::clear and ExternStableVec::clear, which delegate to BitVecCore::clear.

Impact

CWE-415 (Double Free): the same allocation is freed twice.
CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated Drop.

Reachable entirely from safe Rust via catch_unwind with element types whose Drop can panic. Confirmed under AddressSanitizer on 0.4.2.

Fix

Fixed in stable-vec 0.4.3 by removing each element via remove_at, which clears the occupancy bit before taking the value out.

Release 0.4.3 also fixes several other panic-safety issues found by the maintainer; see GHSA-mr2v-63pc-gmr4 and the 0.4.3 changelog for the full list.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / stable-vec

Package

Name: stable-vec; View open source insights on deps.dev
Purl: pkg:cargo/stable-vec

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.4.3

Ecosystem specific

{
    "affects": {
        "arch": [],
        "functions": [
            "stable_vec::BitVecCore::clear"
        ],
        "os": []
    },
    "affected_functions": null
}