RustSec logo

HistoryEditJSON (OSV)

RUSTSEC-2026-0079

DynFuture drop can construct a dangling reference

Reported
Issued
Package
dyn-future (crates.io)
Type
INFO Unsound
References
Patched
no patched versions

Description

DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.

This issue was reproduced against dyn-future 3.0.4 under Miri. And the crate is unmaintained.

Advisory available under CC0-1.0 license.