{"id":"RUSTSEC-2026-0298","summary":"Use-after-free when a future's `Drop` panics while the container is dropped","details":"`Storage::clear` walks the slab, empties each entry and frees the `Task`\nallocation once its reference count reaches zero. `self.tasks.set_len(0)` only\nruns after the loop.\n\nEmptying an entry drops the user future it holds, and `T` carries no bounds\nexcluding a panicking `Drop`. If one unwinds, the length is never committed and\n`self.tasks` still holds the pointers already processed. `Drop for Storage`\ncalls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`\non allocations the first pass already freed — a use-after-free (CWE-416)\nreachable from safe Rust.\n\n`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No\nparticular method call is needed; dropping the container is enough.\n\n## Mitigation\n\nUpdate to 0.10.3.","aliases":["GHSA-8gw6-724c-9h38"],"modified":"2026-09-22T07:45:03.895643389Z","published":"2026-09-12T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/unicycle"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0298.html"},{"type":"WEB","url":"https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd"}],"affected":[{"package":{"name":"unicycle","ecosystem":"crates.io","purl":"pkg:cargo/unicycle"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.3"}]}],"ecosystem_specific":{"affects":{"functions":["unicycle::Unordered::drop"],"arch":[],"os":[]},"affected_functions":null},"database_specific":{"informational":null,"categories":["memory-corruption"],"cvss":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0298.json"}}],"schema_version":"1.9.0"}