{"id":"RUSTSEC-2026-0298","aliases":["GHSA-8gw6-724c-9h38"],"title":"Use-after-free when a future's `Drop` panics while the container is dropped","summary":"Use-after-free when a future's `Drop` panics while the container is dropped","severity":"none","vendor":"unicycle","product":"unicycle","ecosystem":"rust","affected":["unicycle >= 0.0.0-0, < 0.10.3"],"patched":["unicycle 0.10.3"],"published":"2026-09-12","updated":"2026-09-22","sourceUpdated":"2026-09-22T07:45:03.895643389Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0298","references":[{"url":"https://crates.io/crates/unicycle"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0298.html"},{"url":"https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd"}],"tags":["osv","rust"],"ingestedAt":"2026-09-24T07:16:01.870Z","slug":"RUSTSEC-2026-0298","body":"## Overview\n\n`Storage::clear` walks the slab, empties each entry and frees the `Task`\nallocation once its reference count reaches zero. `self.tasks.set_len(0)` only\nruns after the loop.\n\nEmptying an entry drops the user future it holds, and `T` carries no bounds\nexcluding a panicking `Drop`. If one unwinds, the length is never committed and\n`self.tasks` still holds the pointers already processed. `Drop for Storage`\ncalls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`\non allocations the first pass already freed — a use-after-free (CWE-416)\nreachable from safe Rust.\n\n`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No\nparticular method call is needed; dropping the container is enough.\n\n## Mitigation\n\nUpdate to 0.10.3.\n\n## Affected packages\n\n- `unicycle >= 0.0.0-0, < 0.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `unicycle 0.10.3`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}