RUSTSEC-2025-0023

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0023

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0023.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2025-0023

Published

2025-04-07T12:00:00Z

Modified

2025-04-08T09:12:03Z

Summary

Broadcast channel calls clone in parallel, but does not require `Sync`

Details

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tokio

Package

Name: tokio; View open source insights on deps.dev
Purl: pkg:cargo/tokio

Affected ranges

Type: SEMVER
Events: Introduced

0.2.5

Fixed

1.38.2

Introduced

1.39.0

Fixed

1.42.1

Introduced

1.43.0

Fixed

1.43.1

Introduced

1.44.0

Fixed

1.44.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": null,
    "informational": "unsound",
    "categories": [
        "memory-corruption"
    ]
}