GHSA-rvr2-r3pv-5m4p

Source

https://github.com/advisories/GHSA-rvr2-r3pv-5m4p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-rvr2-r3pv-5m4p/GHSA-rvr2-r3pv-5m4p.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-rvr2-r3pv-5m4p

Aliases

RUSTSEC-2026-0005

Published

2026-01-27T00:59:04Z

Modified

2026-01-27T06:11:31.227277Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

oneshot has potential Use After Free when used asynchronously

Details

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.

When the Receiver is polled (Future::poll) it writes a waker to the channel and sets it to the RECEIVING state. If the Receiver was then dropped (instead of polled to completion), the Drop implementation on Receiver unconditionally swapped the channel state to DISCONNECTED and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the DISCONNECTED state could be observed by the Sender, which would lead to it deallocating the channel heap memory. If the Sender manage to free the channel before the Receiver managed to proceed to dropping the waker, then the Receiver would read from the freed channel memory (Use After Free).

The fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of oneshot version 0.1.12.

Database specific

{
    "nvd_published_at": null,
    "github_reviewed": true,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-362",
        "CWE-416"
    ],
    "github_reviewed_at": "2026-01-27T00:59:04Z"
}

References

Affected packages

crates.io / oneshot

Package

Name: oneshot; View open source insights on deps.dev
Purl: pkg:cargo/oneshot

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.1.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-rvr2-r3pv-5m4p/GHSA-rvr2-r3pv-5m4p.json"