Reported

September 12, 2026

Issued

September 22, 2026

Package

unicycle (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#memory-safety #use-after-free #panic-safety

Aliases

• GHSA-8gw6-724c-9h38

References

• https://github.com/udoprog/unicycle/commit/4f1492a266824f8aa66fd6b27fa6188bf826bdfd

Patched

• >=0.10.3

Affected Functions

Version

unicycle::Unordered::drop

• <0.10.3

Description

Storage::clear walks the slab, empties each entry and frees the Task allocation once its reference count reaches zero. self.tasks.set_len(0) only runs after the loop.

Emptying an entry drops the user future it holds, and T carries no bounds excluding a panicking Drop. If one unwinds, the length is never committed and self.tasks still holds the pointers already processed. Drop for Storage calls clear again, and the second pass dereferences (*task.as_ptr()).entry on allocations the first pass already freed — a use-after-free (CWE-416) reachable from safe Rust.

Storage is reached only through Unordered, whose Drop calls clear. No particular method call is needed; dropping the container is enough.

Mitigation

Update to 0.10.3.

Advisory available under CC0-1.0 license.