Unsound HighRUSTSEC-2020-0037 · crayon
RUSTSEC-2020-0037: Misbehaving `HandleLike` implementation can lead to memory safety violation
Short answercrayon has an API that can cause undefined behaviour from safe code: Misbehaving `HandleLike` implementation can lead to memory safety violation. No fixed version yet.
| Crate | crayon |
|---|---|
| Type | Unsound |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High, CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-08-31 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-35889, GHSA-m833-jv95-mfjh |
What to do
- Find who pulls it in:
cargo tree -i crayon. - Avoid the affected API, or replace the crate.
Details from the advisory
Unsafe code in ObjectPool has time-of-check to time-of-use (TOCTOU) bug that can eventually lead to a memory safety violation. ObjectPool and HandlePool implicitly assumes that HandleLike trait methods are pure, i.e., they always return the same value. However, this assumption is unsound since HandleLike is a safe, public trait that allows a custom implementation.
References
- Package: crates.io/crates/crayon
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0037.html
- Report: github.com/shawnscode/crayon/issues/87
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for crayon
Up next
Same cratecrayon: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?