GHSA-j3w3-p6mr-3hrh: DynFuture Drop Can Construct a Dangling Reference

April 4, 2026

DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.

This issue was reproduced against dyn-future 3.0.4 under Miri. The crate is unmaintained.

References

github.com/advisories/GHSA-j3w3-p6mr-3hrh
github.com/rustsec/advisory-db/issues/2595
github.com/xacrimon/dyn-future
rustsec.org/advisories/RUSTSEC-2026-0079.html

Code Behaviors & Features

Detect and mitigate GHSA-j3w3-p6mr-3hrh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →