https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:54:04.075116+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2020-05387 bdu:2020-05387 2026-10-04T08:54:04.293237+00:00 bdu:2020-05387 https://cve.radiocsirt.org/vuln/certfr-2020-avi-660 certfr-2020-avi-660 — De multiples vulnérabilités ont été découvertes dans Mozilla Foundation Firefox. Certaines d'entre elles permettent à u… 2026-10-04T08:54:04.293290+00:00 certfr-2020-avi-660 https://cve.radiocsirt.org/vuln/cnvd-2020-58037 cnvd-2020-58037 2026-10-04T08:54:04.293311+00:00 cnvd-2020-58037 https://cve.radiocsirt.org/vuln/euvd-2026-42788 EUVD-2026-42788 2026-10-04T08:54:04.293325+00:00 EUVD-2026-42788 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15254 fkie_cve-2020-15254 2026-10-04T08:54:04.293341+00:00

Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.

 https://cve.radiocsirt.org/vuln/ghsa-v5m7-53cv-f3hx GHSA-v5m7-53cv-f3hx — crossbeam-channel Undefined Behavior before v0.4.4 2026-10-04T08:54:04.293377+00:00

Affected: crates.io: crossbeam-channel

### Impact

The affected version of this crate's the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.

### Patches

This has been fixed in crossbeam-channel 0.4.4.

We recommend users to upgrade to 0.4.4.

### References

See https://github.com/crossbeam-rs/crossbeam/pull/533, https://github.com/crossbeam-rs/crossbeam/issues/539, and https://github.com/RustSec/advisory-db/pull/425 for more details.

### License

This advisory is in the public domain.

 https://cve.radiocsirt.org/vuln/gsd-2020-15254 gsd-2020-15254 2026-10-04T08:54:04.293413+00:00 gsd-2020-15254 https://cve.radiocsirt.org/vuln/msrc_cve-2020-15254 msrc_CVE-2020-15254 — Undefined Behavior in bounded Crossbeam channel 2026-10-04T08:54:04.293425+00:00 msrc_CVE-2020-15254 https://cve.radiocsirt.org/vuln/opensuse-su-2024:10600-1 openSUSE-SU-2024:10600-1 — MozillaFirefox-92.0-1.2 on GA media 2026-10-04T08:54:04.293442+00:00

MozillaFirefox-92.0-1.2 on GA media

 https://cve.radiocsirt.org/vuln/rustsec-2020-0052 RUSTSEC-2020-0052 — Undefined Behavior in bounded channel 2026-10-04T08:54:04.293823+00:00

Affected: crates.io: crossbeam-channel

The affected version of this crate's the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15254 UBUNTU-CVE-2020-15254 2026-10-04T08:54:04.293848+00:00

Affected: Ubuntu:16.04:LTS: firefox, Ubuntu:18.04:LTS: firefox, Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:20.04:LTS: rust-crossbeam, Ubuntu:22.04:LTS: rust-crossbeam, Ubuntu:24.04:LTS: rust-crossbeam and 2 more

Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.