{"id":"GHSA-rvr2-r3pv-5m4p","aliases":["RUSTSEC-2026-0005"],"status":"published","title":"oneshot has potential Use After Free when used asynchronously","description":"There is a race condition that can lead to a use-after-free if a `oneshot::Receiver` is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.\n\nWhen the `Receiver` is polled (`Future::poll`) it writes a waker to the channel and sets it to the `RECEIVING` state. If the `Receiver` was then dropped (instead of polled to completion), the `Drop` implementation on `Receiver` unconditionally swapped the channel state to `DISCONNECTED` and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the `DISCONNECTED` state could be observed by the `Sender`, which would lead to it deallocating the channel heap memory. If the `Sender` manage to free the channel before the `Receiver` managed to proceed to dropping the waker, then the `Receiver` would read from the freed channel memory (Use After Free).\n\nThe fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of `oneshot` version `0.1.12`.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-416"],"published":"2026-01-25T12:00:00Z","modified":"2026-09-10T03:50:59Z","fixes":[{"ecosystem":"crates.io","package":"oneshot","fixed_in":["0.1.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"oneshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.12"}]}]},{"source":"osv","ecosystem":"crates.io","package":"oneshot","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.12"}]}]},{"source":"osv","ecosystem":"crates.io","package":"oneshot","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.2-0"},{"fixed":"0.1.12"}]}]}],"references":[{"url":"https://github.com/faern/oneshot/issues/73","tags":["web","report"]},{"url":"https://github.com/rustsec/advisory-db/pull/2600","tags":["web"]},{"url":"https://github.com/faern/oneshot/commit/d1a1506010bc48962634807d0dcca682af4f50ba","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0005.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rvr2-r3pv-5m4p"},{"url":"https://github.com/faern/oneshot","tags":["package"]},{"url":"https://crates.io/crates/oneshot","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-rvr2-r3pv-5m4p","title":"oneshot has potential Use After Free when used asynchronously","description":"There is a race condition that can lead to a use-after-free if a `oneshot::Receiver` is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.\n\nWhen the `Receiver` is polled (`Future::poll`) it writes a waker to the channel and sets it to the `RECEIVING` state. If the `Receiver` was then dropped (instead of polled to completion), the `Drop` implementation on `Receiver` unconditionally swapped the channel state to `DISCONNECTED` and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the `DISCONNECTED` state could be observed by the `Sender`, which would lead to it deallocating the channel heap memory. If the `Sender` manage to free the channel before the `Receiver` managed to proceed to dropping the waker, then the `Receiver` would read from the freed channel memory (Use After Free).\n\nThe fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of `oneshot` version `0.1.12`.","status":"published","published":"2026-01-27T00:59:04Z","modified":"2026-01-27T00:59:08Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-362","CWE-416"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"osv":[{"id":"GHSA-rvr2-r3pv-5m4p","title":"oneshot has potential Use After Free when used asynchronously","description":"There is a race condition that can lead to a use-after-free if a `oneshot::Receiver` is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.\n\nWhen the `Receiver` is polled (`Future::poll`) it writes a waker to the channel and sets it to the `RECEIVING` state. If the `Receiver` was then dropped (instead of polled to completion), the `Drop` implementation on `Receiver` unconditionally swapped the channel state to `DISCONNECTED` and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the `DISCONNECTED` state could be observed by the `Sender`, which would lead to it deallocating the channel heap memory. If the `Sender` manage to free the channel before the `Receiver` managed to proceed to dropping the waker, then the `Receiver` would read from the freed channel memory (Use After Free).\n\nThe fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of `oneshot` version `0.1.12`.","status":"published","published":"2026-01-27T00:59:04Z","modified":"2026-09-10T03:50:59.065721671Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-362","CWE-416"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"RUSTSEC-2026-0005","title":"Potential use-after-free in `oneshot` when used asynchronously","description":"There is a race condition that can lead to a use-after-free if a `oneshot::Receiver` is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.\n\nWhen the `Receiver` is polled (`Future::poll`) it writes a waker to the channel and sets it to the `RECEIVING` state. If the `Receiver` was then dropped (instead of polled to completion), the `Drop` implementation on `Receiver` unconditionally swapped the channel state to `DISCONNECTED` and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the `DISCONNECTED` state could be observed by the `Sender`, which would lead to it deallocating the channel heap memory. If the `Sender` manage to free the channel before the `Receiver` managed to proceed to dropping the waker, then the `Receiver` would read from the freed channel memory (use-after-free).\n\nThe fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of `oneshot` version `0.1.12`.","status":"published","published":"2026-01-25T12:00:00Z","modified":"2026-01-27T06:11:17.438685Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}