[renovate]

This PR contains the following updates:

Package	Type	Update	Change
tokio (source)	dependencies	patch	1.54.0 → 1.54.1

---

Tokio: Race condition in tokio::time::Interval

CVE-2026-115567 / GHSA-5wjr-9356-4wc8

More information

Details

Summary

On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.

This affects Interval only. Sleep and Timeout are not affected.

Details

In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.

This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.

Impact

This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.

Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.

Credits

Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.

Severity

• CVSS Score: 5.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8
• https://nvd.nist.gov/vuln/detail/CVE-2026-115567
• https://github.com/tokio-rs/tokio/pull/8458
• https://github.com/tokio-rs/tokio/pull/8692
• https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28d0
• https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99c9
• https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1
• https://rustsec.org/advisories/RUSTSEC-2026-0384.html
• https://github.com/advisories/GHSA-5wjr-9356-4wc8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tokio-rs/tokio (tokio)

v1.54.1: Tokio v1.54.1

Compare Source

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#​8692)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.50%. Comparing base (924f81b) to head (9973059).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #327   +/-   ##
=======================================
  Coverage   79.50%   79.50%           
=======================================
  Files          13       13           
  Lines        2132     2132           
=======================================
  Hits         1695     1695           
  Misses        437      437           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.