Rust advisories / futures-task
Vulnerability HighRUSTSEC-2020-0060 · futures-task
RUSTSEC-2020-0060: futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Short answerA security vulnerability in the futures-task crate: futures_task::waker may cause a use-after-free if used on a type that isn't 'static. High severity (CVSS 7.8). Fixed in 0.3.6: update to a fixed version.
| Crate | futures-task |
|---|---|
| Type | Vulnerability (code-execution, memory-corruption) |
| Affected versions | From 0.2.2 before 0.3.6. |
| Fixed in | 0.3.6 |
| Severity | High, CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-09-04 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-35906, GHSA-r93v-9p5q-vhpf |
| Affected functions | futures_task::waker |
What to do
- See which version you have:
cargo tree -i futures-task(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p futures-task. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplefutures-task = "0.3.6") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped.
The flaw was corrected by adding 'static lifetime bound to the data waker takes.
References
- Package: crates.io/crates/futures-task
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0060.html
- Web: github.com/rust-lang/futures-rs/pull/2206
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for futures-task
Up next
Same cratefutures-task: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?