{"id":"RUSTSEC-2026-0301","summary":"Double free in `StackVec::retain` when a predicate or element `Drop` panics","details":"## Summary\n\n`StackVec::retain` committed its new length to `self.len` only after\nits internal loop completed. If the retain predicate or a removed\nelement's `Drop` implementation panicked before the loop finished,\nunwinding proceeded with `self.len` still equal to the original,\npre-retain length, leaving either a duplicated or already-destroyed\nelement inside `0..len`. `StackVec`'s own `Drop` then revisited that\nslot, causing a double-drop (and for heap-owning types, a double-free).\n\n## Impact\n\nAffects `StackVec\u003cT, CAP\u003e::retain` for `T: Drop` types where the\npredicate or the removed element's destructor can panic, on builds\nwith unwinding enabled (`panic = \"unwind\"`). `no_std`/`panic = \"abort\"`\nbuilds cannot trigger this, since unwinding never occurs.\n\n## Patch\n\nFixed in 0.3.3 using an unwind-safe backshift guard, matching the\napproach `alloc::vec::Vec::retain` uses.","modified":"2026-09-22T21:00:02.870917912Z","published":"2026-09-22T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/stack_collections"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0301.html"},{"type":"WEB","url":"https://github.com/OverwrittenCode/stack_collections/pull/4"}],"affected":[{"package":{"name":"stack_collections","ecosystem":"crates.io","purl":"pkg:cargo/stack_collections"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.3"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0301.json","categories":["memory-corruption"]}}],"schema_version":"1.9.0"}