GitHub Advisoryadvisory · crates.io

GHSA-j3w3-p6mr-3hrh DynFuture Drop Can Construct a Dangling Reference

MEDIUM Published 2026-04-04 Modified 2026-04-04 Official page ↗
Ecosystem
crates.io
Packages
dyn-future
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-843
Reviewed
2026-04-04

Affected packages

• crates.io dyn-future: <= 3.0.4 (no fix yet)

Description

DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata. This issue was reproduced against `dyn-future` 3.0.4 under Miri. The crate is unmaintained.

Related

Weakness · CWE (1)

  • CWE-843 Access of Resource Using Incompatible Type weakness

References