GHSA-36xm-35qq-795w
Inventory exposes reference to non-Sync data to an arbitrary thread
Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them.
A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.
The flaw was corrected by enforcing that data submitted by the caller into inventory is Sync.
What each source reports
GitHub AdvisoriesNo score
Inventory exposes reference to non-Sync data to an arbitrary thread
Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them.
A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.
The flaw was corrected by enforcing that data submitted by the caller into inventory is Sync.
- Record
GHSA-36xm-35qq-795w- Updated
- 2026-11-02
OSVNo score
Inventory exposes reference to non-Sync data to an arbitrary thread
Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them.
A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.
The flaw was corrected by enforcing that data submitted by the caller into inventory is Sync.
- Record
GHSA-36xm-35qq-795w- Updated
- 2026-11-02
OSVRUSTSEC-2023-0058No score
Exposes reference to non-Sync data to an arbitrary thread
Affected versions do not enforce a Sync bound on the type of caller-provided
value held in the plugin registry. References to these values are made
accessible to arbitrary threads other than the one that constructed them.
A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.
The flaw was corrected by enforcing that data submitted by the caller into
inventory is Sync.
- Record
RUSTSEC-2023-0058- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-36xm-35qq-795w is a vulnerability with no CVSS score yet in inventory, published September 10, 2023. No source lists public exploit code. Fixed in inventory 0.2.0.