RUSTSEC-2026-0454

Dashboard / Vulnerabilities / RUSTSEC-2026-0454

RUSTSEC-2026-0454

Summary: Data race and double free via unsound `Send`/`Sync` in `reblessive`

Details: `dbs::Executor` drives every SurrealQL statement through `reblessive::tree::TreeStack`. In `reblessive 0.4.3` the runtime types unconditionally assert `Send`/`Sync` (`unsafe impl Send/Sync for Stack`, `TreeStack` and `Runner`), while the public entry points accept any future without a `Send` bound and store it type-erased in a bump allocator. Two safe-code consequences follow. First, `Runner::step_async`/`finish_async` return driver futures tied to the stack borrow rather than to `&mut self`, so a driver future can be duplicated; because `Stack` is `Sync` those futures are `Send`, and polling two copies on different threads runs `drive_top_task` concurrently — racy `Cell`/`UnsafeCell` access, double `pop_task()`/`pop_dealloc()` (double drop / double free) and a non-atomic `Option::take`. Second, `TreeStack: Send` lets safe code move a driver whose type-erased future captures `!Send` state (`Rc`, `RefCell`) to another thread while the creating thread keeps an alias of that state. No `unsafe` is needed at the call site. `surrealdb-core`'s own query futures are `Send` only because of the unsound `unsafe impl Send for TreeStack`, while the captured `&mut tree::Stk` is deliberately `!Send`. The unsound dependency was removed in 4.0.0 and the parser now uses plain recursion (commit `75407c4bcc`).

References: https://crates.io/crates/surrealdb-core, https://rustsec.org/advisories/RUSTSEC-2026-0454.html, https://github.com/surrealdb/surrealdb/commit/75407c4bccc6d6679d7d6e7a18af0065afdded7d