oneshot

Activity

Latest release: 6mo ago
Total releases: 16
Cadence: ~3 months
Last 12 months: 4

Details

License: MIT OR Apache-2.0
First release: May 30, 2019

Releases

Version	Released
`0.2.1` unknown	Feb 23, 2026
`0.2.0` unknown	Feb 23, 2026
`0.1.13` unknown	Jan 26, 2026
`0.1.12` unknown	Jan 25, 2026
`0.1.11` unknown 1 CVE	Feb 22, 2025
`0.1.10` unknown 1 CVE	Feb 04, 2025
`0.1.9` unknown 1 CVE	Feb 02, 2025
`0.1.8` unknown 1 CVE	Jun 13, 2024
`0.1.7` unknown 1 CVE	May 24, 2024
`0.1.6` unknown 1 CVE	Sep 14, 2023
`0.1.5` unknown 1 CVE	Sep 01, 2022
`0.1.4` unknown 1 CVE	Aug 30, 2022
`0.1.3` unknown yanked 1 CVE	Nov 23, 2021
`0.1.2` unknown yanked 1 CVE	Aug 11, 2020
`0.1.1` unknown yanked 1 CVE	May 09, 2020
`0.1.0` unknown yanked 1 CVE	May 30, 2019

Dependencies (4)

Depends on

0.2.1

Used by

188

Supply-chain exposure

188 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

1 of 4

async-std 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

GHSA-rvr2-r3pv-5m4p RUSTSEC-2026-0005 Jan 27, 2026

oneshot has potential Use After Free when used asynchronously

High
Network High None None

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.

When the Receiver is polled (Future::poll) it writes a waker to the channel and sets it to the RECEIVING state. If the Receiver was then dropped (instead of polled to completion), the Drop implementation on Receiver unconditionally swapped the channel state to DISCONNECTED and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the DISCONNECTED state could be observed by the Sender, which would lead to it deallocating the channel heap memory. If the Sender manage to free the channel before the Receiver managed to proceed to dropping the waker, then the Receiver would read from the freed channel memory (Use After Free).

The fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of oneshot version 0.1.12.

Fixed in

0.1.12

References

https://github.com/faern/oneshot/issues/73
https://github.com/rustsec/advisory-db/pull/2600
https://github.com/faern/oneshot/commit/d1a1506010bc48962634807d0dcca682af4f50ba
https://github.com/faern/oneshot
https://rustsec.org/advisories/RUSTSEC-2026-0005.html

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

unknown 16

16 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More