https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:51:45.060407+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-33537 EUVD-2026-33537 2026-10-04T08:51:45.407953+00:00 EUVD-2026-33537 https://cve.radiocsirt.org/vuln/fkie_cve-2021-45710 fkie_cve-2021-45710 2026-10-04T08:51:45.407999+00:00

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.

 https://cve.radiocsirt.org/vuln/ghsa-fg7r-2g4j-5cgr GHSA-fg7r-2g4j-5cgr — Race Condition in tokio 2026-10-04T08:51:45.408037+00:00

Affected: crates.io: tokio

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.

 https://cve.radiocsirt.org/vuln/gsd-2021-45710 gsd-2021-45710 2026-10-04T08:51:45.408069+00:00 gsd-2021-45710 https://cve.radiocsirt.org/vuln/opensuse-su-2024:0294-1 openSUSE-SU-2024:0294-1 — Security update for kanidm 2026-10-04T08:51:45.408083+00:00

Security update for kanidm

 https://cve.radiocsirt.org/vuln/rustsec-2021-0124 RUSTSEC-2021-0124 — Data race when sending and receiving after closing a `oneshot` channel 2026-10-04T08:51:45.408103+00:00

Affected: crates.io: tokio

If a `tokio::sync::oneshot` channel is closed (via the [`oneshot::Receiver::close`] method), a data race may occur if the `oneshot::Sender::send` method is called while the corresponding `oneshot::Receiver` is `await`ed or calling `try_recv`.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to [cause memory corruption][corruption].

Note that the race only occurs when **both** halves of the channel are used after the `Receiver` half has called `close`. Code where `close` is not used, or where the `Receiver` is not `await`ed and `try_recv` is not called after calling `close`, is not affected.

See [tokio#4225][issue] for more details.

[corruption]: https://github.com/tokio-rs/tokio/issues/4225#issuecomment-967434847 [issue]: https://github.com/tokio-rs/tokio/issues/4225 [`oneshot::Receiver::close`]: https://docs.rs/tokio/1.14.0/tokio/sync/oneshot/struct.Receiver.html#method.close

 https://cve.radiocsirt.org/vuln/suse-su-2022:3949-1 SUSE-SU-2022:3949-1 — Security update for rustup 2026-10-04T08:51:45.408132+00:00

Security update for rustup

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-45710 UBUNTU-CVE-2021-45710 2026-10-04T08:51:45.408149+00:00

Affected: Ubuntu:20.04:LTS: rust-tokio, Ubuntu:22.04:LTS: rust-tokio, Ubuntu:24.04:LTS: rust-tokio, Ubuntu:25.10: rust-tokio, Ubuntu:26.04:LTS: rust-tokio

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.