crates.io stable-vec vulnerabilities

Latest crates.io stable-vec CVEs

Newest publication first

1. RUSTSEC-2026-0267 Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

   Published 2026-08-24

   Unknown

   BitVecCore::clear drops every occupied element with drop_in_place and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.