CVE-2020-36437
Data race in conqueue
An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
8.1
An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
- Record
CVE-2020-36437- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
- Record
CVE-2020-36437- Updated
- 2026-11-02
EUVDEUVD-2021-1530 No score
An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
- Record
EUVD-2021-1530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-368f-29c3-4f2r
8.1
Data race in conqueue
Affected versions of this crate unconditionally implemented Send/Sync for QueueSender<T>, allowing to send non-Send T to other threads by invoking (&QueueSender<T>).send().
This fails to prevent users from creating data races by sending types like Rc<T> or Arc<Cell<T>> to other threads, which can lead to memory corruption. The flaw was corrected in commit 1e462c3 by imposing T: Send to both Send/Sync impls for QueueSender<T>/QueueReceiver<T>.
- Record
GHSA-368f-29c3-4f2r- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-362
- Updated
- 2026-11-02
OSV
8.1
An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
- Record
CVE-2020-36437- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-368f-29c3-4f2r
8.1
Data race in conqueue
Affected versions of this crate unconditionally implemented Send/Sync for QueueSender<T>, allowing to send non-Send T to other threads by invoking (&QueueSender<T>).send().
This fails to prevent users from creating data races by sending types like Rc<T> or Arc<Cell<T>> to other threads, which can lead to memory corruption. The flaw was corrected in commit 1e462c3 by imposing T: Send to both Send/Sync impls for QueueSender<T>/QueueReceiver<T>.
- Record
GHSA-368f-29c3-4f2r- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-362
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0117
8.1
QueueSender<T>/QueueReceiver<T>: Send/Sync impls need `T: Send`
Affected versions of this crate unconditionally implemented Send/Sync for QueueSender<T>,
allowing to send non-Send T to other threads by invoking (&QueueSender<T>).send().
This fails to prevent users from creating data races by sending types like Rc<T> or Arc<Cell<T>> to other threads, which can lead to memory corruption.
The flaw was corrected in commit 1e462c3 by imposing T: Send to both Send/Sync impls for QueueSender<T>/QueueReceiver<T>.
- Record
RUSTSEC-2020-0117- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36437 is a high vulnerability (CVSS 8.1) in Conqueue Project Conqueue, published November 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in conqueue 0.4.0.
References
rustsec.org/advisories/RUSTSEC-2020-0117.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/conqueue/RUSTSEC-2020-0117.md
nvd.nist.gov/vuln/detail/CVE-2020-36437
github.com/longshorej/conqueue/commit/1e462c32e7933821ddb26dc49fd4ffa5aeca97b8
github.com/advisories/GHSA-368f-29c3-4f2r
github.com/longshorej/conqueue
crates.io/crates/conqueue
github.com/longshorej/conqueue/issues/9