https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T16:11:28.959374+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-48059 EUVD-2026-48059 2026-10-16T16:11:29.055811+00:00 EUVD-2026-48059 https://cve.radiocsirt.org/vuln/fkie_cve-2020-36203 fkie_cve-2020-36203 2026-10-16T16:11:29.055857+00:00

An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.

 https://cve.radiocsirt.org/vuln/ghsa-39xg-8p43-h76x GHSA-39xg-8p43-h76x — Data races in reffers 2026-10-16T16:11:29.055890+00:00

Affected: crates.io: reffers

ARefss<'a, V> is a type that is assumed to contain objects that are Send + Sync.

In the affected versions of this crate, Send/Sync traits are unconditionally implemented for ARefss<'a, V>.

By using the ARefss::map() API, we can insert a !Send or !Sync object into ARefss<'a, V>. After that, it is possible to create a data race to the inner object of ARefss<'a, V>, which can lead to undefined behavior & memory corruption.

The flaw was corrected in commit `6dd7ca0` by adding trait bound V: Send + Sync to ARefss::map() API.

 https://cve.radiocsirt.org/vuln/gsd-2020-36203 gsd-2020-36203 2026-10-16T16:11:29.055922+00:00 gsd-2020-36203 https://cve.radiocsirt.org/vuln/rustsec-2020-0094 RUSTSEC-2020-0094 — Unsound: can make `ARefss` contain a !Send, !Sync object. 2026-10-16T16:11:29.055934+00:00

Affected: crates.io: reffers

`ARefss<'a, V>` is a type that is assumed to contain objects that are `Send + Sync`.

In the affected versions of this crate, `Send`/`Sync` traits are unconditionally implemented for `ARefss<'a, V>`.

By using the `ARefss::map()` API, we can insert a `!Send` or `!Sync` object into `ARefss<'a, V>`. After that, it is possible to create a data race to the inner object of `ARefss<'a, V>`, which can lead to undefined behavior & memory corruption.

The flaw was corrected in commit 6dd7ca0 (https://github.com/diwic/reffers-rs/commit/6dd7ca0d50f2464df708975cdafcfaeeb6d41c66) by adding trait bound `V: Send + Sync` to `ARefss::map()` API.