RUSTSEC-2026-0301 Double free in `StackVec::retain` when a predicate or element `Drop` panics
A double-free vulnerability in StackVec::retain allows attackers to cause memory corruption or crashes if a panic occurs during element removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0301?
RUSTSEC-2026-0301 is a memory corruption vulnerability in stack_collections, published on 22 Sep 2026.
Official description
Summary
StackVec::retain committed its new length to self.len only after
its internal loop completed. If the retain predicate or a removed
element's Drop implementation panicked before the loop finished,
unwinding proceeded with self.len still equal to the original,
pre-retain length, leaving either a duplicated or already-destroyed
element inside 0..len. StackVec's own Drop then revisited that
slot, causing a double-drop (and for heap-owning types, a double-free).
Impact
Affects StackVec<T, CAP>::retain for T: Drop types where the
predicate or the removed element's destructor can panic, on builds
with unwinding enabled (panic = "unwind"). no_std/panic = "abort"
builds cannot trigger this, since unwinding never occurs.
Patch
Fixed in 0.3.3 using an unwind-safe backshift guard, matching the
approach alloc::vec::Vec::retain uses.
Which versions are affected by RUSTSEC-2026-0301?
1 open source package ship an affected version, including stack_collections.
| Package | Affected | Fixed in |
|---|---|---|
stack_collections crates.io | From 0.3.0 | 0.3.3 |
How do I fix RUSTSEC-2026-0301?
Upgrade stack_collections to 0.3.3 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2026-0301 being exploited?
There is no known exploitation of RUSTSEC-2026-0301 in the wild and no public exploit code.