CVE-2020-35906: futures_task::waker may cause a use-after-free if used on a type that isn't 'static

May 24, 2022 (updated October 30, 2025)

Affected versions of the crate did not properly implement a ‘static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped.

The flaw was corrected by adding ‘static lifetime bound to the data waker takes.

References

github.com/advisories/GHSA-r93v-9p5q-vhpf
github.com/rust-lang/futures-rs
github.com/rust-lang/futures-rs/pull/2206
nvd.nist.gov/vuln/detail/CVE-2020-35906
rustsec.org/advisories/RUSTSEC-2020-0060.html

Code Behaviors & Features

Detect and mitigate CVE-2020-35906 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →