{"id":"RUSTSEC-2026-0267","summary":"Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)","details":"`BitVecCore::clear` drops every occupied element with `drop_in_place` and only\nafterwards clears the occupancy bits and resets `len`. If an element's `Drop`\npanics, those metadata updates are skipped, so the slot of the already-dropped\nelement stays marked as occupied. `BitVecCore::drop` calls `clear()` again,\nvisits the same slot, and drops the element a second time — a double-free /\nuse-after-free reachable from safe Rust.\n\nReachable via the public `StableVec::clear` and `ExternStableVec::clear`, which\ndelegate to `BitVecCore::clear`.\n\n## Impact\n\n* CWE-415 (Double Free): the same allocation is freed twice.\n* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.\n\nReachable entirely from safe Rust via `catch_unwind` with element types whose\n`Drop` can panic. Confirmed under AddressSanitizer on 0.4.2.\n\n## Fix\n\nFixed in `stable-vec` 0.4.3 by removing each element via `remove_at`, which\nclears the occupancy bit before taking the value out.\n\nRelease 0.4.3 also fixes several other panic-safety issues found by the\nmaintainer; see [GHSA-mr2v-63pc-gmr4](https://github.com/LukasKalbertodt/stable-vec/security/advisories/GHSA-mr2v-63pc-gmr4)\nand the 0.4.3 changelog for the full list.","aliases":["GHSA-mr2v-63pc-gmr4"],"modified":"2026-08-25T02:45:03.396225962Z","published":"2026-08-24T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/stable-vec"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0267.html"},{"type":"WEB","url":"https://github.com/LukasKalbertodt/stable-vec/pull/51"}],"affected":[{"package":{"name":"stable-vec","ecosystem":"crates.io","purl":"pkg:cargo/stable-vec"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.3"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":["stable_vec::BitVecCore::clear"]},"affected_functions":null},"database_specific":{"informational":"unsound","categories":["memory-corruption"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0267.json","cvss":null}}],"schema_version":"1.9.0"}