Rust advisories / atomic-option
Vulnerability MediumRUSTSEC-2020-0113 · atomic-option
RUSTSEC-2020-0113: AtomicOption should have Send + Sync bound on its type argument.
Short answerA security vulnerability in the atomic-option crate: AtomicOption should have Send + Sync bound on its type argument.. Medium severity (CVSS 5.9). No fixed version: replace the crate or remove the affected code path.
| Crate | atomic-option |
|---|---|
| Type | Vulnerability (memory-corruption, thread-safety) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium, CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2020-10-31 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-36219, GHSA-8gf5-q9p9-wvmc |
What to do
- Find who pulls it in:
cargo tree -i atomic-option. - Avoid the affected API, or replace the crate.
Details from the advisory
In the affected versions of this crate, AtomicOption<T> unconditionally implements Sync.
This allows programmers to move non-Sync types across thread boundaries (e.g. Rc<T>, Arc<Cell<T>>), which can lead to data races and undefined behavior. It is also possible to send non-Send types like std::sync::MutexGuard to other threads, which can lead to undefined behavior.
References
- Package: crates.io/crates/atomic-option
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0113.html
- Report: github.com/reem/rust-atomic-option/issues/4
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?