CVE-2020-36462
Duplicate Advisory: Data races on syncpool
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
- Record
CVE-2020-36462- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
- Record
CVE-2020-36462- Updated
- 2026-11-02
EUVDEUVD-2021-1898 No score
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
- Record
EUVD-2021-1898- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r88h-6987-g79f
Duplicate Advisory: Data races on syncpool
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vp6r-mrq9-8f4h. This link is maintained to preserve external references.
Original Description
Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads.
This can lead to data races when non Send types like Cell<T> or Rc<T> are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).
The flaw was corrected in commit 15b2828 by adding a T: Send bound to the Send impl of Bucket2<T>.
- Record
GHSA-r88h-6987-g79f- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vp6r-mrq9-8f4h
Data race in syncpool
Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads. This can lead to data races when non Send types like Cell<T> or Rc<T> are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue). The flaw was corrected in commit 15b2828 by adding a T: Send bound to the Send impl of Bucket2<T>.
- Record
GHSA-vp6r-mrq9-8f4h- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-362
- Updated
- 2026-11-02
OSVGHSA-r88h-6987-g79f
Duplicate Advisory: Data races on syncpool
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vp6r-mrq9-8f4h. This link is maintained to preserve external references.
Original Description
Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads.
This can lead to data races when non Send types like Cell<T> or Rc<T> are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).
The flaw was corrected in commit 15b2828 by adding a T: Send bound to the Send impl of Bucket2<T>.
- Record
GHSA-r88h-6987-g79f- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-vp6r-mrq9-8f4h
Data race in syncpool
Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads. This can lead to data races when non Send types like Cell<T> or Rc<T> are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue). The flaw was corrected in commit 15b2828 by adding a T: Send bound to the Send impl of Bucket2<T>.
- Record
GHSA-vp6r-mrq9-8f4h- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-362, CWE-77
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0142
Send bound needed on T (for Send impl of `Bucket2`)
Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads.
This can lead to data races when non Send types like Cell<T> or Rc<T> are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).
The flaw was corrected in commit 15b2828 by adding a T: Send bound to the Send impl of Bucket2<T>.
- Record
RUSTSEC-2020-0142- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36462 is a high vulnerability (CVSS 8.1) in Syncpool Project Syncpool, published November 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in syncpool 0.1.6.
References
rustsec.org/advisories/RUSTSEC-2020-0142.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/syncpool/RUSTSEC-2020-0142.md
github.com/Chopinsky/byte_buffer/issues/2