[security][medium] Cancelled pooled client operations can return dirty sockets as reusable

[leynos]

Summary

If an in-flight pooled operation is cancelled while the peer later sends a response, the connection can be dropped back into the pool without being marked broken.

Tracking

Canonical finding id: csf_2b5c8cec7725c430a93723b0

Primary fingerprint: codex-security/v1:sha256:14b27a137cbcc0fa3112a30719627cc881fc5a8094da10c7f29a90329321ef0a

Scan id: 3969c3b0af5f_20260624T110328Z

Candidate ids: WF-POOL-CANCEL-STALE-REUSE

Severity

Severity: medium

Confidence: medium

CWE: CWE-664

Rationale: This is a cross-request state confusion risk with realistic faulty-peer preconditions, but exploit reliability depends on caller cancellation and response type, so severity is medium with medium confidence.

Source

Repository: https://github.com/leynos/wireframe

Scanned target: git_worktree snapshot at revision 3969c3b

Source status: unverified for commit-pinned links because the sealed target kind is git_worktree; locations are listed as canonical plain paths.

• Location (root_control): src/client/pool/lease.rs:51-62
• Location (sink): src/client/pool/slot.rs:141-148
• Location (supporting_control): src/client/pool/manager.rs:42-48

Root cause

The invariant should be that cancellation during an in-flight request makes the socket unusable until drained or re-synchronized. The implementation only marks broken after a completed operation returns a recyclable error.

Recommended fix

Mark a pooled connection broken when a lease future is dropped with an operation in flight, or wrap operations in a cancellation guard that invalidates the socket unless completion proves it is synchronized.

Regression tests

• Add a cancellation test: hold a pooled call in-flight, drop the future, inject a late response, and assert the next lease reconnects rather than reuses the socket.

Public issue note

This issue intentionally omits code snippets and detailed attack-path notes from the sealed scan report.