CVE-2026-115567 Tokio: Race condition in `tokio::time::Interval`
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115567?
CVE-2026-115567 is a medium-severity vulnerability in tokio-rs tokio, published on 23 Oct 2026.
Official description
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.
Weakness: CWE-362
Which versions are affected by CVE-2026-115567?
3 open source packages ship an affected version, including tokio.
| Package | Affected | Fixed in |
|---|---|---|
tokio crates.io | From 1.54.0 | 1.54.1 |
tokio crates.io | From 1.54.0 | 1.54.1 |
tokio crates.io | From 1.54.0 | 1.54.1 |
How do I fix CVE-2026-115567?
Upgrade tokio to 1.54.1 or later.
Is CVE-2026-115567 being exploited?
There is no known exploitation of CVE-2026-115567 in the wild and no public exploit code.
Sources
Also known as GHSA-5wjr-9356-4wc8, RUSTSEC-2026-0384.