RUSTSEC-2025-0166: Multiple soundness issues in `stackvector`

What to do

1. See which version you have: cargo tree -i stackvector (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p stackvector. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example stackvector = "2.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of stackvector contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.

One issue was that StackVec::length was exposed as a public field. Safe Rust code could set length to a value larger than the backing array capacity. Other safe methods, including remove, pop, and truncate, relied on length before performing unsafe pointer operations (ptr::read, ptr::copy, offset/add). If length was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.

The upstream maintainer also identified additional soundness issues, including the use of mem::uninitialized in StackVec::from_vec_unchecked, which was reachable through from_vec, and Miri violations related to MaybeUninit usage.

Version 2.0.0 was released to fix the known soundness issues.

References

• Package: crates.io/crates/stackvector
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0166.html
• Report: github.com/Alexhuszagh/rust-stackvector/issues/3
• Web: github.com/Alexhuszagh/rust-stackvector/pull/6
• Web: github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357
• Report: github.com/Alexhuszagh/rust-stackvector/issues/5

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for stackvector

• Vulnerability HighRUSTSEC-2021-0048 · 2021-02-19StackVec::extend can write out of bounds when size_hint is incorrect

Full security history of stackvector