{"answers":{"affected":"1 open source package ship an affected version, including stable-vec.","exploited":"There is no known exploitation of RUSTSEC-2026-0267 in the wild and no public exploit code.","fix":"Upgrade stable-vec to 0.4.3 or later.","what":"RUSTSEC-2026-0267 is an use after free vulnerability in stable-vec, published on 24 Aug 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0267 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0267 is an use after free vulnerability in stable-vec, published on 24 Aug 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0267 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- stable-vec (crates.io): affected from 0.0.0-0; fixed in 0.4.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0267/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0267/index.md)","id":"RUSTSEC-2026-0267","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0267/index.md","name":"RUSTSEC-2026-0267","record":{"aliases":["GHSA-mr2v-63pc-gmr4"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust stable-vec library","requires_auth":"none","summary":"A panic during element drop in BitVecCore::clear causes double-free and use-after-free, allowing memory corruption or crashes in applications using stable-vec.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"`BitVecCore::clear` drops every occupied element with `drop_in_place` and only\nafterwards clears the occupancy bits and resets `len`. If an element's `Drop`\npanics, those metadata updates are skipped, so the slot of the already-dropped\nelement stays marked as occupied. `BitVecCore::drop` calls `clear()` again,\nvisits the same slot, and drops the element a second time — a double-free /\nuse-after-free reachable from safe Rust.\n\nReachable via the public `StableVec::clear` and `ExternStableVec::clear`, which\ndelegate to `BitVecCore::clear`.\n\n## Impact\n\n* CWE-415 (Double Free): the same allocation is freed twice.\n* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.\n\nReachable entirely from safe Rust via `catch_unwind` with element types whose\n`Drop` can panic. Confirmed under AddressSanitizer on 0.4.2.\n\n## Fix\n\nFixed in `stable-vec` 0.4.3 by removing each element via `remove_at`, which\nclears the occupancy bit before taking the value out.\n\nRelease 0.4.3 also fixes several other panic-safety issues found by the\nmaintainer; see [GHSA-mr2v-63pc-gmr4](https://github.com/LukasKalbertodt/stable-vec/security/advisories/GHSA-mr2v-63pc-gmr4)\nand the 0.4.3 changelog for the full list.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)","id":"RUSTSEC-2026-0267","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.4.3"],"introduced":["0.0.0-0"],"last_affected":[],"package":"stable-vec","purl":"pkg:cargo/stable-vec","source":"RUSTSEC-2026-0267"}],"products":null,"published":"2026-08-24","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A panic during element drop in BitVecCore::clear causes double-free and use-after-free, allowing memory corruption or crashes in applications using stable-vec.","url":"https://insights.sbomify.com/RUSTSEC-2026-0267/"}