AIKIDO-2026-10368

TL;DR

Affected versions of this package are affected by a memory safety vulnerability in OnceCell::wait when the parking_lot feature is enabled. Under certain race conditions where one thread calls wait() while another thread attempts initialization using get_or_try_init, a panic during initialization may cause wait() to return even though initialization did not complete. As a result, the waiting thread may observe the cell as initialized while it actually contains uninitialized memory, leading to undefined behavior. The issue is addressed by correcting the synchronization logic to ensure wait() only returns after successful initialization.