GHSA-5wjr-9356-4wc8

Source

https://github.com/advisories/GHSA-5wjr-9356-4wc8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wjr-9356-4wc8/GHSA-5wjr-9356-4wc8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5wjr-9356-4wc8

Aliases

CVE-2026-115567
RUSTSEC-2026-0384

Published

2026-10-23T20:54:00Z

Modified

2026-10-23T21:10:33Z

Severity

5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Tokio: Race condition in `tokio::time::Interval`

Details

Summary

On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.

This affects Interval only. Sleep and Timeout are not affected.

Details

In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.

This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.

Impact

This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.

Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.

Credits

Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.

Database specific

{
    "cwe_ids":  [
        "CWE-362"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T20:54:00Z",
    "nvd_published_at":  "2026-10-23T18:17:21Z",
    "severity":  "MODERATE"
}

References

Affected packages

crates.io / tokio

Package

Name: tokio; View open source insights on deps.dev
Purl: pkg:cargo/tokio

Affected ranges

Type: SEMVER
Events: Introduced

1.54.0

Fixed

1.54.1

Affected versions

1.*

1.54.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wjr-9356-4wc8/GHSA-5wjr-9356-4wc8.json"