CVE-2026-115567

Name of the Vulnerable Software and Affected Versions Tokio version 1.54.0

Description A race condition exists on the multi-threaded runtime between the tokio::time::Interval::poll tick() function (including .tick().await) and the runtime's time driver. This occurs when an internal timer entry is dropped without synchronization with the driver thread that is firing it. This leads to a data race and use-after-free on the timer's waker and task state, which can result in assertion panics, task reference-count corruption, or heap memory corruption. This issue specifically affects Interval and does not impact Sleep or Timeout.

Recommendations Update Tokio to version 1.54.1.