Rust advisories / crossbeam-channel
Vulnerability MediumRUSTSEC-2020-0052 · crossbeam-channel
RUSTSEC-2020-0052: Undefined Behavior in bounded channel
Short answerA security vulnerability in the crossbeam-channel crate: Undefined Behavior in bounded channel. GitHub rates it Medium. Fixed in 0.4.4: update to a fixed version.
| Crate | crossbeam-channel |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | From 0.4.3 before 0.4.4. |
| Fixed in | 0.4.4 |
| Severity | Medium (GitHub rating) |
| Published | 2020-06-26 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-15254, CVE-2020-35904, GHSA-m8h8-v6jh-c762, GHSA-v5m7-53cv-f3hx |
What to do
- See which version you have:
cargo tree -i crossbeam-channel(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p crossbeam-channel. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplecrossbeam-channel = "0.4.4") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The affected version of this crate's the bounded channel incorrectly assumes that Vec::from_iter has allocated capacity that same as the number of iterator elements. Vec::from_iter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::from_iter has allocated different sizes with the number of iterator elements.
References
- Package: crates.io/crates/crossbeam-channel
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0052.html
- Web: github.com/crossbeam-rs/crossbeam/pull/533
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for crossbeam-channel
Up next
Same cratecrossbeam-channel: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?