RUSTSEC-2026-0300: Use-after-free in `clear` and `retain` when an element's `Drop` panics

What to do

1. See which version you have: cargo tree -i skiplist (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p skiplist. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example skiplist = "1.1.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

References

• Package: crates.io/crates/skiplist
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0300.html
• Web: github.com/JP-Ellis/rust-skiplist/pull/334

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.