https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T02:54:11.186967+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-36203 CVE-2020-36203 2026-10-16T02:54:11.220878+00:00

An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.

 https://cve.radiocsirt.org/vuln/ghsa-39xg-8p43-h76x GHSA-39xg-8p43-h76x — Data races in reffers 2026-10-16T02:54:11.220935+00:00

Affected: crates.io: reffers

ARefss<'a, V> is a type that is assumed to contain objects that are Send + Sync.

In the affected versions of this crate, Send/Sync traits are unconditionally implemented for ARefss<'a, V>.

By using the ARefss::map() API, we can insert a !Send or !Sync object into ARefss<'a, V>. After that, it is possible to create a data race to the inner object of ARefss<'a, V>, which can lead to undefined behavior & memory corruption.

The flaw was corrected in commit `6dd7ca0` by adding trait bound V: Send + Sync to ARefss::map() API.