RUSTSEC-2026-0298 (GHSA-8GW6-724C-9H38)
Vulnerability from osv_rustsec – Published: 2026-09-12 12:00 – Updated: 2026-09-22 07:35 – Source websiteStorage::clear walks the slab, empties each entry and frees the Task
allocation once its reference count reaches zero. self.tasks.set_len(0) only
runs after the loop.
Emptying an entry drops the user future it holds, and T carries no bounds
excluding a panicking Drop. If one unwinds, the length is never committed and
self.tasks still holds the pointers already processed. Drop for Storage
calls clear again, and the second pass dereferences (*task.as_ptr()).entry
on allocations the first pass already freed — a use-after-free (CWE-416)
reachable from safe Rust.
Storage is reached only through Unordered, whose Drop calls clear. No
particular method call is needed; dropping the container is enough.
Mitigation
Update to 0.10.3.
{
"affected": [
{
"database_specific": {
"categories": [
"memory-corruption"
],
"cvss": null,
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"unicycle::Unordered::drop"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "unicycle",
"purl": "pkg:cargo/unicycle"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.10.3"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [
"GHSA-8gw6-724c-9h38"
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "`Storage::clear` walks the slab, empties each entry and frees the `Task`\nallocation once its reference count reaches zero. `self.tasks.set_len(0)` only\nruns after the loop.\n\nEmptying an entry drops the user future it holds, and `T` carries no bounds\nexcluding a panicking `Drop`. If one unwinds, the length is never committed and\n`self.tasks` still holds the pointers already processed. `Drop for Storage`\ncalls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`\non allocations the first pass already freed \u2014 a use-after-free (CWE-416)\nreachable from safe Rust.\n\n`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No\nparticular method call is needed; dropping the container is enough.\n\n## Mitigation\n\nUpdate to 0.10.3.",
"id": "RUSTSEC-2026-0298",
"modified": "2026-09-22T07:35:37Z",
"published": "2026-09-12T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/unicycle"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0298.html"
},
{
"type": "WEB",
"url": "https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd"
}
],
"related": [],
"severity": [],
"summary": "Use-after-free when a future\u0027s `Drop` panics while the container is dropped"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.