GHSA-8gw6-724c-9h38
Use-after-free when a future's `Drop` panics while the container is dropped
GHSA-8gw6-724c-9h38 is a vulnerability with no CVSS score yet in unicycle, published September 12, 2026. No source lists public exploit code. Fixed in unicycle 0.10.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.10.3unicycle
Description
Storage::clear walks the slab, empties each entry and frees the Task
allocation once its reference count reaches zero. self.tasks.set_len(0) only
runs after the loop.
Emptying an entry drops the user future it holds, and T carries no bounds
excluding a panicking Drop. If one unwinds, the length is never committed and
self.tasks still holds the pointers already processed. Drop for Storage
calls clear again, and the second pass dereferences (*task.as_ptr()).entry
on allocations the first pass already freed — a use-after-free (CWE-416)
reachable from safe Rust.
Storage is reached only through Unordered, whose Drop calls clear. No
particular method call is needed; dropping the container is enough.
Mitigation
Update to 0.10.3.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unicyclecrates.io | 0.0.0-0 up to 0.10.3 | 0.10.3 |
What each source reports
OSVRUSTSEC-2026-0298No score
Use-after-free when a future's `Drop` panics while the container is dropped
Storage::clear walks the slab, empties each entry and frees the Task
allocation once its reference count reaches zero. self.tasks.set_len(0) only
runs after the loop.
Emptying an entry drops the user future it holds, and T carries no bounds
excluding a panicking Drop. If one unwinds, the length is never committed and
self.tasks still holds the pointers already processed. Drop for Storage
calls clear again, and the second pass dereferences (*task.as_ptr()).entry
on allocations the first pass already freed — a use-after-free (CWE-416)
reachable from safe Rust.
Storage is reached only through Unordered, whose Drop calls clear. No
particular method call is needed; dropping the container is enough.
Mitigation
Update to 0.10.3.
- Record
RUSTSEC-2026-0298- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.