crates.io stack_dst vulnerabilities

Latest crates.io stack_dst CVEs

Newest publication first

1. RUSTSEC-2026-0272 Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)

   Published 2026-08-27

   Unknown

   Three removal and replacement paths destroy an initialized value before committing the metadata change that removes it. Destruction runs T::drop(), which is user code and may panic. If it does, the commit is skipped and the container still claims ownership of the already-destroye...

2. CVE-2021-28034 Double free in stack_dst

   Published 2021-03-05

   Critical·CVSS 9.8 EPSS 1.3%

   An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic.

3. CVE-2021-28035 Drop of uninitialized memory in stack_dst

   Published 2021-03-05

   Critical·CVSS 9.8 EPSS 1.3%

   An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uninitialized memory can occur upon a val.clone() panic.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.