---
id: RUSTSEC-2026-0298
aliases:
  - GHSA-8gw6-724c-9h38
title: Use-after-free when a future's `Drop` panics while the container is dropped
summary: Use-after-free when a future's `Drop` panics while the container is dropped
severity: none
vendor: unicycle
product: unicycle
ecosystem: rust
affected:
  - 'unicycle >= 0.0.0-0, < 0.10.3'
patched:
  - unicycle 0.10.3
published: '2026-09-12'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T07:45:03.895643389Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0298'
references:
  - url: 'https://crates.io/crates/unicycle'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0298.html'
  - url: >-
      https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd
tags:
  - osv
  - rust
ingestedAt: '2026-09-24T07:16:01.870Z'
---

## Overview

`Storage::clear` walks the slab, empties each entry and frees the `Task`
allocation once its reference count reaches zero. `self.tasks.set_len(0)` only
runs after the loop.

Emptying an entry drops the user future it holds, and `T` carries no bounds
excluding a panicking `Drop`. If one unwinds, the length is never committed and
`self.tasks` still holds the pointers already processed. `Drop for Storage`
calls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`
on allocations the first pass already freed — a use-after-free (CWE-416)
reachable from safe Rust.

`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No
particular method call is needed; dropping the container is enough.

## Mitigation

Update to 0.10.3.

## Affected packages

- `unicycle >= 0.0.0-0, < 0.10.3`

## Remediation

Upgrade to a patched release:

- `unicycle 0.10.3`