GHSA-c8v3-jhv9-4ppc
Use-after-free when setting the locale
Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc<String>. The locale can be read with AtomicStr::as_str(). AtomicStr::as_str() does not increment the usage counter of the Arc.
If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.
What each source reports
GitHub AdvisoriesNo score
Use-after-free when setting the locale
Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc<String>. The locale can be read with AtomicStr::as_str(). AtomicStr::as_str() does not increment the usage counter of the Arc.
If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.
- Record
GHSA-c8v3-jhv9-4ppc- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVNo score
Use-after-free when setting the locale
Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc<String>. The locale can be read with AtomicStr::as_str(). AtomicStr::as_str() does not increment the usage counter of the Arc.
If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.
- Record
GHSA-c8v3-jhv9-4ppc- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRUSTSEC-2024-0007No score
Use-after-free when setting the locale
Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale.
It stores the locale as a raw pointer to an Arc<String>.
The locale can be read with AtomicStr::as_str().
AtomicStr::as_str() does not increment the usage counter of the Arc.
If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.
- Record
RUSTSEC-2024-0007- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rust-i18n-supportcrates.io | 3.0.0 up to 3.0.1 | 3.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-c8v3-jhv9-4ppc is a vulnerability with no CVSS score yet in rust-i18n-support, published January 19, 2024. No source lists public exploit code. Fixed in rust-i18n-support 3.0.1.
References
github.com/longbridgeapp/rust-i18n/issues/71
rustsec.org/advisories/RUSTSEC-2024-0007.html
crates.io/crates/rust-i18n-support