GitHub Advisoryadvisory · crates.io

GHSA-r93v-9p5q-vhpf futures_task::waker may cause a use-after-free if used on a type that isn't 'static

HIGH Published 2022-05-24 Modified 2025-10-30 Official page ↗
Aliases
CVE-2020-35906
Ecosystem
crates.io
Packages
futures-task
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-416
Reviewed
2022-06-16

Affected packages

• crates.io futures-task: >= 0.2.1, < 0.3.6 → fixed in 0.3.6

Description

Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped. The flaw was corrected by adding 'static lifetime bound to the data waker takes.

Related

Alias · CVE (1)

  • CVE-2020-35906 An issue was discovered in the futures-task crate before 0.3.6 for Rust. vulnerability

Weakness · CWE (1)

References