RUSTSEC-2026-0267 Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

BitVecCore::clear drops every occupied element with dropinplace and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop calls clear again,...

Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

BitVecCore::clear drops every occupied element with dropinplace and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop calls clear again,...