CVE-2026-27204: Wasi Async Resource Leak Bypass

A vector is declared, populated, and then drained for manual cleanup entirely within an async block. If the async block contains early returns (like `?`), the manual cleanup loop may be bypassed, leading to resource leaks. Consider declaring the vector outside the async block and performing the cleanup after the async block has resolved.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Rust
greprules fetch cve-2026-27204-wasi-async-resource-leak-bypass --engine opengrep

Description

A vector is declared, populated, and then drained for manual cleanup entirely within an async block. If the async block contains early returns (like `?`), the manual cleanup loop may be bypassed, leading to resource leaks. Consider declaring the vector outside the async block and performing the cleanup after the async block has resolved.