RUSTSEC-2021-0124: Data race when sending and receiving after closing a `oneshot` channel

What to do

1. See which version you have: cargo tree -i tokio (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p tokio. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example tokio = "1.8.4") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when **both** halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.

See tokio#4225 for more details.

References

• Package: crates.io/crates/tokio
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0124.html
• Report: github.com/tokio-rs/tokio/issues/4225

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for tokio

• VulnerabilityRUSTSEC-2021-0072 · 2021-07-07Task dropped in wrong thread when aborting `LocalSet` task
• VulnerabilityRUSTSEC-2023-0001 · 2023-01-04reject_remote_clients Configuration corruption
• UnsoundRUSTSEC-2023-0005 · 2023-01-11`tokio::io::ReadHalf<T>::unsplit` is Unsound
• UnsoundRUSTSEC-2025-0023 · 2025-04-07Broadcast channel calls clone in parallel, but does not require `Sync`
• VulnerabilityRUSTSEC-2026-0384 · 2026-10-21Race condition in `tokio::time::Interval` on Tokio v1.54.0
• UnsoundRUSTSEC-2026-0386 · 2026-10-13`AsyncFd::new` and related constructors violate I/O safety

Full security history of tokio