crates.io stack_collections vulnerabilities

Latest crates.io stack_collections CVEs

Newest publication first

1. RUSTSEC-2026-0301 Double free in `StackVec::retain` when a predicate or element `Drop` panics

   Published 2026-09-22

   Unknown

   Summary StackVec::retain committed its new length to self.len only after its internal loop completed. If the retain predicate or a removed element's Drop implementation panicked before the loop finished, unwinding proceeded with self.len still equal to the original, pre-retain le...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.