{"affected":[{"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0298.json"},"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["unicycle::Unordered::drop"],"os":[]}},"package":{"ecosystem":"crates.io","name":"unicycle","purl":"pkg:cargo/unicycle"},"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.3"}],"type":"SEMVER"}]}],"aliases":["GHSA-8gw6-724c-9h38"],"database_specific":{"license":"CC0-1.0"},"details":"`Storage::clear` walks the slab, empties each entry and frees the `Task`\nallocation once its reference count reaches zero. `self.tasks.set_len(0)` only\nruns after the loop.\n\nEmptying an entry drops the user future it holds, and `T` carries no bounds\nexcluding a panicking `Drop`. If one unwinds, the length is never committed and\n`self.tasks` still holds the pointers already processed. `Drop for Storage`\ncalls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry`\non allocations the first pass already freed — a use-after-free (CWE-416)\nreachable from safe Rust.\n\n`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No\nparticular method call is needed; dropping the container is enough.\n\n## Mitigation\n\nUpdate to 0.10.3.","id":"RUSTSEC-2026-0298","modified":"2026-09-22T07:45:03.895643389Z","published":"2026-09-12T12:00:00Z","references":[{"type":"PACKAGE","url":"https://crates.io/crates/unicycle"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0298.html"},{"type":"WEB","url":"https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd"}],"schema_version":"1.9.0","summary":"Use-after-free when a future's `Drop` panics while the container is dropped"}