CVE-2020-36471
Data races in generator
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
- Record
CVE-2020-36471- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
- Record
CVE-2020-36471- Updated
- 2026-11-02
EUVDEUVD-2021-1906 No score
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
- Record
EUVD-2021-1906- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3g5-2848-2v8r
Data races in generator
The Generator type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no Send bounds despite the Generator itself implementing Send.
The generator function lacking a Send bound means that types that are
dangerous to send across threads such as Rc could be sent as part of a
generator, potentially leading to data races.
This flaw was fixed in commit f7d120a3b
by enforcing that the generator function be bound by Send.
- Record
GHSA-w3g5-2848-2v8r- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
- Record
CVE-2020-36471- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-36471
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
- Record
DEBIAN-CVE-2020-36471- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-w3g5-2848-2v8r
Data races in generator
The Generator type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no Send bounds despite the Generator itself implementing Send.
The generator function lacking a Send bound means that types that are
dangerous to send across threads such as Rc could be sent as part of a
generator, potentially leading to data races.
This flaw was fixed in commit f7d120a3b
by enforcing that the generator function be bound by Send.
- Record
GHSA-w3g5-2848-2v8r- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0151
Generators can cause data races if non-Send types are used in their generator functions
The Generator type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no Send bounds despite the Generator itself implementing Send.
The generator function lacking a Send bound means that types that are
dangerous to send across threads such as Rc could be sent as part of a
generator, potentially leading to data races.
This flaw was fixed in commit f7d120a3b
by enforcing that the generator function be bound by Send.
- Record
RUSTSEC-2020-0151- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-36471
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
- Record
UBUNTU-CVE-2020-36471- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
generatorcrates.io |
before 0.7.0 | 0.7.0 |
rust-generatorDebian:12 |
before 0.7.1-1 | 0.7.1-1 |
rust-generatorDebian:13 |
before 0.7.1-1 | 0.7.1-1 |
rust-generatorDebian:14 |
before 0.7.1-1 | 0.7.1-1 |
generatorcrates.io |
0.0.0-0 up to 0.7.0 | 0.7.0 |
rust-generatorUbuntu:22.04:LTS |
All versions, plus listed versions 0.6.20-20.6.20-3 |
None known |
rust-generatorUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.1-1 |
None known |
rust-generatorUbuntu:25.10 |
All versions, plus listed versions 0.7.1-1.1 |
None known |
rust-generatorUbuntu:26.10 |
All versions, plus listed versions 0.7.1-1.1 |
None known |
rust-generatorUbuntu:26.04:LTS |
All versions, plus listed versions 0.7.1-1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36471 is a medium vulnerability (CVSS 5.9) in Generator Project Generator, published November 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in generator 0.7.0.
References
rustsec.org/advisories/RUSTSEC-2020-0151.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/generator/RUSTSEC-2020-0151.md
nvd.nist.gov/vuln/detail/CVE-2020-36471
github.com/Xudong-Huang/generator-rs/issues/27