{"id":"GHSA-8gw6-724c-9h38","aliases":["RUSTSEC-2026-0298"],"status":"published","title":"Use-after-free when a future's `Drop` panics while the container is dropped","description":"`Storage::clear` walks the slab, empties each entry and frees the `Task`\nallocation once its reference count reaches zero. `self.tasks.set_len(0)` only\nruns after the loop.\n\nEmptying an entry drops the user future it holds, and `T` carries no bounds\nexcluding a panicking `Drop`. If one unwinds, the length is never committed and\n`self.tasks` still holds the pointers already processed. `Drop for Storage`\ncalls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`\non allocations the first pass already freed — a use-after-free (CWE-416)\nreachable from safe Rust.\n\n`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No\nparticular method call is needed; dropping the container is enough.\n\n## Mitigation\n\nUpdate to 0.10.3.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-12T12:00:00Z","modified":"2026-09-22T07:45:03Z","fixes":[{"ecosystem":"crates.io","package":"unicycle","fixed_in":["0.10.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"unicycle","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.3"}]}]}],"references":[{"url":"https://crates.io/crates/unicycle","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0298.html","tags":["advisory"]},{"url":"https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0298","title":"Use-after-free when a future's `Drop` panics while the container is dropped","description":"`Storage::clear` walks the slab, empties each entry and frees the `Task`\nallocation once its reference count reaches zero. `self.tasks.set_len(0)` only\nruns after the loop.\n\nEmptying an entry drops the user future it holds, and `T` carries no bounds\nexcluding a panicking `Drop`. If one unwinds, the length is never committed and\n`self.tasks` still holds the pointers already processed. `Drop for Storage`\ncalls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`\non allocations the first pass already freed — a use-after-free (CWE-416)\nreachable from safe Rust.\n\n`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No\nparticular method call is needed; dropping the container is enough.\n\n## Mitigation\n\nUpdate to 0.10.3.","status":"published","published":"2026-09-12T12:00:00Z","modified":"2026-09-22T07:45:03.895643389Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}