GHSA-j3w3-p6mr-3hrh: DynFuture Drop Can Construct a Dangling Reference

April 4, 2026

DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.

This issue was reproduced against dyn-future 3.0.4 under Miri. The crate is unmaintained.

References

github.com/advisories/GHSA-j3w3-p6mr-3hrh
github.com/rustsec/advisory-db/issues/2595
github.com/xacrimon/dyn-future
rustsec.org/advisories/RUSTSEC-2026-0079.html

Code Behaviors & Features

Detect and mitigate GHSA-j3w3-p6mr-3hrh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →