CVE-2020-35908
Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Record
CVE-2020-35908- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Record
CVE-2020-35908- Updated
- 2026-11-02
EUVDEUVD-2022-2648 No score
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Record
EUVD-2022-2648- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5r9g-j7jj-hw6c
Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Record
GHSA-5r9g-j7jj-hw6c- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Record
CVE-2020-35908- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-5r9g-j7jj-hw6c
Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
- Record
GHSA-5r9g-j7jj-hw6c- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRUSTSEC-2020-0062
Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
Affected versions of the crate had an unsound Sync implementation on the FuturesUnordered structure, which used a Cell for
interior mutability without any code to handle synchronized access to the underlying task list's length and head safely.
This could of lead to data corruption since two threads modifying the list at once could see incorrect values due to the lack of access synchronization.
The issue was fixed by adding access synchronization code around insertion of tasks into the list.
- Record
RUSTSEC-2020-0062- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
futures-utilcrates.io |
0.3.0 up to 0.3.2 | 0.3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35908 is a medium vulnerability (CVSS 5.5) in Rust-lang Future-utils, published January 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in futures-util 0.3.2.