{"id":"CVE-2026-115567","aliases":[],"cve":{"records":[{"id":"CVE-2026-115567","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-22T22:53:15.237Z","published":"2026-10-23T17:13:16.161Z","modified":"2026-10-29T17:59:47.636Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T17:13:16.161Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T17:59:47.636Z"}],"references":[{"url":"https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/tokio-rs/tokio/pull/8458","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/tokio-rs/tokio/pull/8692","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28d0","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99c9","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-362","description":"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T17:59:30.494310Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Tokio: Race condition in `tokio::time::Interval`","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.","score":5.8,"severity":"medium","published":"2026-10-23T17:13:16.161Z","modified":"2026-10-29T17:59:47.636Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"tokio-rs","name":"tokio","platforms":[],"versions":[{"version":"= 1.54.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-115567"}],"remediation":[],"references":["https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8","https://github.com/tokio-rs/tokio/pull/8458","https://github.com/tokio-rs/tokio/pull/8692","https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28d0","https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99c9","https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1"],"sources":[{"name":"CVE","id":"CVE-2026-115567","modified":"2026-10-29T17:59:47.636Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115567"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","score":5.8}],"sourceAffected":[],"observedAt":"2026-10-29T18:47:07.723Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T09:10:32.456Z","attemptedAt":"2026-10-30T09:10:32.456Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T09:10:32.565Z","attemptedAt":"2026-10-30T09:10:32.565Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T09:10:32.662Z","attemptedAt":"2026-10-30T09:10:32.662Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T09:10:32.446Z","attemptedAt":"2026-10-30T09:10:32.446Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-115567","url":"https://www.first.org/epss/","probability":0.00111,"percentile":0.01293,"date":"2026-10-29","checkedAt":"2026-10-30T09:10:32.446Z"},{"source":"NVD","id":"CVE-2026-115567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115567","modified":"2026-10-29T18:17:24.127","score":5.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T09:10:32.456Z"},{"source":"GitHub Advisory Database","id":"GHSA-5wjr-9356-4wc8","url":"https://github.com/advisories/GHSA-5wjr-9356-4wc8","modified":"2026-10-23T20:54:01Z","checkedAt":"2026-10-30T09:10:32.565Z"},{"source":"ENISA EUVD","id":"EUVD-2026-109110","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109110","modified":"Oct 29, 2026, 5:59:47 PM","score":5.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T09:10:32.662Z"}],"aiSummary":{"text":"Tokio 1.54.0 has a race condition in `tokio::time::Interval` that can cause use-after-free, leading to assertion panics or memory corruption. The issue occurs between the `poll_tick` method and the multi-threaded runtime's time driver. Access to the affected version is required to exploit the weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:52:19.213Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115567"}]}}