{"id":"RUSTSEC-2026-0453","summary":"Use-after-free in KV backends via leaked `affinitypool::spawn_local` future","details":"The `kv-mem`, `kv-surrealkv` and `kv-rocksdb` backends move non-`'static` borrowed state into affinity-pool closures through `affinitypool::spawn_local`: a `tokio::sync::MutexGuard\u003cOption\u003cTransactionInner\u003e\u003e`, `&Transaction`, `&mut ScanStateKeys/Vals`, `&mut dyn KeyVisitor/ValVisitor`, `RwLockReadGuard`, and a `ReadOptions` holding a raw `rocksdb_snapshot_t*`. In `affinitypool 0.7.0` `spawn_local` is safe and erases the `'pool` lifetime via `async_task::Builder::spawn_unchecked`; the only thing keeping it sound is the `Drop` implementation of the returned future, which blocks until the worker stops using the borrows.\n\nSafe code can leak that future (`mem::forget`, `Box::leak`, `ManuallyDrop`, a reference cycle, or a leaked enclosing future). The borrows then end while the pool worker still uses them, producing a use-after-free on the transaction allocation; AddressSanitizer reports a read of freed mutex data and a write when the worker unlocks the freed `tokio::sync::Mutex` on the pool thread. No `unsafe` is required at the call site, and the affected methods include `count`, `keys`/`keysr`, `scan`/`scanr`, `compact`, shutdown, point reads and writes, and cursor iteration.\n\n3.3.0 upgrades to `affinitypool 0.8.0`, where `spawn_local` is an `unsafe` function and the caller must uphold the leak-freedom invariant (commit `8156ff69`).","aliases":["CVE-2026-121417","GHSA-pm86-cc75-q463"],"modified":"2026-11-06T15:55:56.754284946Z","published":"2026-10-19T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/surrealdb"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0453.html"},{"type":"WEB","url":"https://github.com/surrealdb/surrealdb/commit/8156ff691b1861814199e5e3372c81609b68db7f"}],"affected":[{"package":{"name":"surrealdb","ecosystem":"crates.io","purl":"pkg:cargo/surrealdb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.3.0"}]}],"ecosystem_specific":{"affects":{"functions":[],"arch":[],"os":[]},"affected_functions":null},"database_specific":{"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0453.json","categories":["memory-corruption"],"cvss":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}