CVE-2020-36472
Data races in max7301
An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain.
- Record
CVE-2020-36472- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain.
- Record
CVE-2020-36472- Updated
- 2026-11-02
EUVDEUVD-2021-1872 No score
An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain.
- Record
EUVD-2021-1872- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rmff-f8w9-c9rm
Data races in max7301
The ImmediateIO and TransactionalIO types implement Sync for all contained
Expander<EI> types regardless of if the Expander itself is safe to use
across threads.
As the IO types allow retrieving the Expander, this can lead to non-thread
safe types being sent across threads as part of the Expander leading to data
races.
- Record
GHSA-rmff-f8w9-c9rm- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-rmff-f8w9-c9rm
Data races in max7301
The ImmediateIO and TransactionalIO types implement Sync for all contained
Expander<EI> types regardless of if the Expander itself is safe to use
across threads.
As the IO types allow retrieving the Expander, this can lead to non-thread
safe types being sent across threads as part of the Expander leading to data
races.
- Record
GHSA-rmff-f8w9-c9rm- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0152
ImmediateIO and TransactionalIO can cause data races
The ImmediateIO and TransactionalIO types implement Sync for all contained
Expander<EI> types regardless of if the Expander itself is safe to use
across threads.
As the IO types allow retrieving the Expander, this can lead to non-thread
safe types being sent across threads as part of the Expander leading to data
races.
- Record
RUSTSEC-2020-0152- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36472 is a medium vulnerability (CVSS 5.9) in Max7301 Project Max7301, published December 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in max7301 0.2.0.
References
rustsec.org/advisories/RUSTSEC-2020-0152.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/max7301/RUSTSEC-2020-0152.md
github.com/edarc/max7301/issues/1
nvd.nist.gov/vuln/detail/CVE-2020-36472
crates.io/crates/max7301