GHSA-w443-5h3j-jqcp

Source

https://github.com/advisories/GHSA-w443-5h3j-jqcp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-w443-5h3j-jqcp/GHSA-w443-5h3j-jqcp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w443-5h3j-jqcp

Withdrawn

2025-05-15T18:26:22Z

Published

2025-05-14T00:32:21Z

Modified

2025-05-15T18:26:22Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator

Summary

Duplicate Advisory: crossbeam-channel Vulnerable to Double Free on Drop

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pg9f-39pc-qf8g. This link is maintained to preserve external references.

Original Description

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Database specific

{
    "cwe_ids":  [
        "CWE-415"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-05-15T18:26:22Z",
    "nvd_published_at":  "2025-05-13T22:15:25Z",
    "severity":  "MODERATE"
}

References

Affected packages

crates.io / crossbeam-channel

Package

Name: crossbeam-channel; View open source insights on deps.dev
Purl: pkg:cargo/crossbeam-channel

Affected ranges

Type: SEMVER
Events: Introduced

0.5.11

Fixed

0.5.15

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-w443-5h3j-jqcp/GHSA-w443-5h3j-jqcp.json"