{"id":"RUSTSEC-2026-0079","summary":"`DynFuture` drop can construct a dangling reference","details":"DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.\n\nThis issue was reproduced against `dyn-future` 3.0.4 under Miri. And the crate is unmaintained.","aliases":["GHSA-j3w3-p6mr-3hrh"],"modified":"2026-04-05T05:30:42Z","published":"2026-01-21T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/dyn-future"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0079.html"},{"type":"REPORT","url":"https://github.com/rustsec/advisory-db/issues/2595"}],"affected":[{"package":{"name":"dyn-future","ecosystem":"crates.io","purl":"pkg:cargo/dyn-future"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affects":{"os":[],"arch":[],"functions":[]},"affected_functions":null},"database_specific":{"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0079.json","cvss":null,"categories":[],"informational":"unsound"}}],"schema_version":"1.7.5"}