{"id":"GHSA-j3w3-p6mr-3hrh","aliases":["RUSTSEC-2026-0079"],"url":"https://o3.security/vulnerability/GHSA-j3w3-p6mr-3hrh","summary":"DynFuture Drop Can Construct a Dangling Reference","details":"DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.\n\nThis issue was reproduced against `dyn-future` 3.0.4 under Miri. The crate is unmaintained.","published":"2026-04-04T05:55:51Z","modified":"2026-04-05T05:56:19.401879988Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"dyn-future","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/rustsec/advisory-db/issues/2595"},{"type":"PACKAGE","url":"https://github.com/xacrimon/dyn-future"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0079.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-05T05:56:19.401879988Z"}}