CVE-2026-23631: Do Not Free Yielding Engine Sync

Missing yielding state verification during synchronization payload handling can lead to Use-After-Free if the underlying engine is replaced or freed. Ensure that asynchronous synchronization defers execution while scripts are currently yielding.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0C
greprules fetch cve-2026-23631-do-not-free-yielding-engine-sync --engine opengrep

Description

Missing yielding state verification during synchronization payload handling can lead to Use-After-Free if the underlying engine is replaced or freed. Ensure that asynchronous synchronization defers execution while scripts are currently yielding.