Rust advisories / crossbeam-deque
Vulnerability CriticalRUSTSEC-2021-0093 · crossbeam-deque
RUSTSEC-2021-0093: Data race in crossbeam-deque
Short answerA security vulnerability in the crossbeam-deque crate: Data race in crossbeam-deque. Critical severity (CVSS 9.8). Fixed in 0.7.4, 0.8.1: update to a fixed version.
| Crate | crossbeam-deque |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Before 0.7.4; from 0.8.0 before 0.8.1. |
| Fixed in | 0.7.4, 0.8.1 |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-07-30 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2021-32810, GHSA-pqqp-xmhj-wgcw |
What to do
- See which version you have:
cargo tree -i crossbeam-deque(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p crossbeam-deque. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplecrossbeam-deque = "0.8.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug.
Crates using Stealer::steal, Stealer::steal_batch, or Stealer::steal_batch_and_pop are affected by this issue.
Credits to @kmaork for discovering, reporting and fixing the bug.
References
- Package: crates.io/crates/crossbeam-deque
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0093.html
- Web: github.com/crossbeam-rs/crossbeam/commit/38c07fcf09920532dc928e775d48b629337313ee
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same cratecrossbeam-deque: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?