GHSA-rr8g-9fpq-6wmg

Source

https://github.com/advisories/GHSA-rr8g-9fpq-6wmg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-rr8g-9fpq-6wmg/GHSA-rr8g-9fpq-6wmg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rr8g-9fpq-6wmg

Related

Published

2025-04-07T21:12:50Z

Modified

2025-04-07T21:12:50Z

Severity

2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Tokio broadcast channel calls clone in parallel, but does not require `Sync`

Details

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-664"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-07T21:12:50Z"
}

References

Affected packages

crates.io / tokio

Package

Name: tokio; View open source insights on deps.dev
Purl: pkg:cargo/tokio

Affected ranges

Type: SEMVER
Events: Introduced

1.44.0

Fixed

1.44.2

crates.io / tokio

Package

Name: tokio; View open source insights on deps.dev
Purl: pkg:cargo/tokio

Affected ranges

Type: SEMVER
Events: Introduced

0.2.5

Fixed

1.38.2

crates.io / tokio

Package

Name: tokio; View open source insights on deps.dev
Purl: pkg:cargo/tokio

Affected ranges

Type: SEMVER
Events: Introduced

1.39.0

Fixed

1.43.1