RUSTSEC-2020-0045: bespoke Cell implementation allows obtaining several mutable references to the same data

What to do

1. See which version you have: cargo tree -i actix-utils (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p actix-utils. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example actix-utils = "2.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The custom implementation of a Cell primitive in the affected versions of this crate does not keep track of mutable references to the underlying data.

This allows obtaining several mutable references to the same object which may result in arbitrary memory corruption, most likely use-after-free.

The flaw was corrected by switching from a bespoke Cell<T> implementation to Rc<RefCell<T>>.

References

• Package: crates.io/crates/actix-utils
• Advisory: rustsec.org/advisories/RUSTSEC-2020-0045.html
• Report: github.com/actix/actix-net/issues/160

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.