RUSTSEC-2026-0298

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0298

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0298.json

JSON Data

https://api.test.osv.dev/v1/vulns/RUSTSEC-2026-0298

Aliases

GHSA-8gw6-724c-9h38

Published

2026-09-12T12:00:00Z

Modified

2026-09-22T07:45:03Z

Summary

Use-after-free when a future's `Drop` panics while the container is dropped

Details

Storage::clear walks the slab, empties each entry and frees the Task allocation once its reference count reaches zero. self.tasks.set_len(0) only runs after the loop.

Emptying an entry drops the user future it holds, and T carries no bounds excluding a panicking Drop. If one unwinds, the length is never committed and self.tasks still holds the pointers already processed. Drop for Storage calls clear again, and the second pass dereferences (*task.as_ptr()).entry on allocations the first pass already freed — a use-after-free (CWE-416) reachable from safe Rust.

Storage is reached only through Unordered, whose Drop calls clear. No particular method call is needed; dropping the container is enough.

Mitigation

Update to 0.10.3.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / unicycle

Package

Name: unicycle; View open source insights on deps.dev
Purl: pkg:cargo/unicycle

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.10.3

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "unicycle::Unordered::drop"
        ],
        "os":  []
    }
}