RUSTSEC-2026-0298

`Storage::clear` walks the slab, empties each entry and frees the `Task` allocation once its reference count reaches zero. `self.tasks.set_len(0)` only runs after the loop.

Emptying an entry drops the user future it holds, and `T` carries no bounds excluding a panicking `Drop`. If one unwinds, the length is never committed and `self.tasks` still holds the pointers already processed. `Drop for Storage` calls `clear` again, and the second pass dereferences `(*task.as_ptr()).entry` on allocations the first pass already freed — a use-after-free (CWE-416) reachable from safe Rust.

`Storage` is reached only through `Unordered`, whose `Drop` calls `clear`. No particular method call is needed; dropping the container is enough.

## Mitigation

Update to 0.10.3.