GHSA-rr8g-9fpq-6wmg
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
GHSA-rr8g-9fpq-6wmg is a low vulnerability (CVSS 2.7) in tokio, published April 7, 2025. No source lists public exploit code. Fixed in tokio 1.44.2.
- Severity
- 2.7 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.44.2tokio +3 more
Description
The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.
Thank you to Austin Bonander for finding and reporting this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
What each source reports
GitHub Advisories Score used
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.
Thank you to Austin Bonander for finding and reporting this issue.
- Record
GHSA-rr8g-9fpq-6wmg- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-664
- Updated
- 2026-11-02
OSV
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.
Thank you to Austin Bonander for finding and reporting this issue.
- Record
GHSA-rr8g-9fpq-6wmg- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-664
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0023No score
Broadcast channel calls clone in parallel, but does not require `Sync`
The broadcast channel internally calls clone on the stored value when
receiving it, and only requires T:Send. This means that using the broadcast
channel with values that are Send but not Sync can trigger unsoundness if
the clone implementation makes use of the value being !Sync.
Thank you to Austin Bonander for finding and reporting this issue.
- Record
RUSTSEC-2025-0023- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.