Description
Affected versions of `stackvector` contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.
One issue was that `StackVec::length` was exposed as a public field. Safe Rust code could set `length` to a value larger than the backing array capacity. Other safe methods, including `remove`, `pop`, and `truncate`, relied on `length` before performing unsafe pointer operations (`ptr::read`, `ptr::copy`, `offset`/`add`). If `length` was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.
The upstream maintainer also identified additional soundness issues, including the use of `mem::uninitialized` in `StackVec::from_vec_unchecked`, which was reachable through `from_vec`, and Miri violations related to `MaybeUninit` usage.
Version `2.0.0` was released to fix the known soundness issues.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | stackvector | >= 0.0.0-0, < 2.0.0 | 2.0.0 | RUSTSEC-2025-0166 |
References
- https://crates.io/crates/stackvector package
- https://rustsec.org/advisories/RUSTSEC-2025-0166.html advisory
- https://github.com/Alexhuszagh/rust-stackvector/issues/3 report
- https://github.com/Alexhuszagh/rust-stackvector/pull/6 web
- https://github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357 web
- https://github.com/Alexhuszagh/rust-stackvector/issues/5 report