Rust advisories / dyn-future
Unsound MediumRUSTSEC-2026-0079 · dyn-future
RUSTSEC-2026-0079: `DynFuture` drop can construct a dangling reference
Short answerdyn-future has an API that can cause undefined behaviour from safe code: `DynFuture` drop can construct a dangling reference. No fixed version yet.
| Crate | dyn-future |
|---|---|
| Type | Unsound |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2026-01-21 |
| Last changed | 2026-04-05 |
| Also known as | GHSA-j3w3-p6mr-3hrh |
What to do
- Find who pulls it in:
cargo tree -i dyn-future. - Avoid the affected API, or replace the crate.
Details from the advisory
DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.
This issue was reproduced against dyn-future 3.0.4 under Miri. And the crate is unmaintained.
References
- Package: crates.io/crates/dyn-future
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0079.html
- Report: github.com/rustsec/advisory-db/issues/2595
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?