GHSA-2qv5-7mw5-j3cg

Source

https://github.com/advisories/GHSA-2qv5-7mw5-j3cg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-2qv5-7mw5-j3cg/GHSA-2qv5-7mw5-j3cg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2qv5-7mw5-j3cg

Aliases

RUSTSEC-2023-0031

Downstream

CGA (6)

Published

2023-04-03T22:53:18Z

Modified

2026-09-10T03:49:53Z

Summary

spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers

Details

Once::try_call_once is unsound if invoked more than once concurrently and any call fails to initialise successfully.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-04-03T22:53:18Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

crates.io / spin

Package

Name: spin; View open source insights on deps.dev
Purl: pkg:cargo/spin

Affected ranges

Type: SEMVER
Events: Introduced

0.9.3

Fixed

0.9.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-2qv5-7mw5-j3cg/GHSA-2qv5-7mw5-j3cg.json"