-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stems from the waker function's missing 'static bound on its generic type parameter. Multiple sources confirm this: 1) The RustSec advisory explicitly lists futures_task::waker as the affected function. 2) The GitHub PR #2206 shows the fix adding the 'static bound to the function signature. 3) The CVE description demonstrates how non-'static data leads to use-after-free through this function. The function's role in creating wakers from potentially short-lived data makes it the clear entry point for the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| futures-task | rust | >= 0.2.1, < 0.3.6 | 0.3.6 |
Ongoing coverage of React2Shell