CVE-2026-121417GHSA-pm86-cc75-q463RUSTSEC-2026-0453
affinitypool::spawn_local futureSurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| surrealdbcrates.io | >= 0.0.0-0, < 3.3.0 | 3.3.0 | OSV |
0.2%9th percentile
Bar shows rank among all scored CVEs.
Published
First publication at the source
Collected
First seen by Baba Yaga Security
Last modified
Latest change at the source