{"id":"CVE-2020-35882","aliases":["EUVD-2021-1643","GHSA-8q2v-67v7-6vc6","RUSTSEC-2020-0028"],"status":"published","title":"Data races in rocket","description":"An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00969,"percentile":0.62294,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2020-05-27T12:00:00Z","modified":"2026-10-24T10:30:19Z","fixes":[{"ecosystem":"crates.io","package":"rocket","fixed_in":["0.4.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rocket","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.4.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rocket","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.4.5"}]}]}],"products":[{"vendor":"rocket","product":"rocket"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0028.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35882","tags":["advisory"]},{"url":"https://github.com/SergioBenitez/Rocket/issues/1312","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-8q2v-67v7-6vc6"},{"url":"https://github.com/SergioBenitez/Rocket","tags":["package"]},{"url":"https://crates.io/crates/rocket","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35882","description":"An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.","status":"published","published":"2020-12-31T08:26:10Z","modified":"2024-08-04T17:16:13.163Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2021-1643","description":"An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.","status":"published","published":"2020-12-31T08:26:10Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-8q2v-67v7-6vc6","title":"Data races in rocket","description":"The affected version of rocket contains a Clone trait implementation of LocalRequest that reuses the pointer to inner Request object. This causes data race in rare combinations of APIs if the original and the cloned objects are modified at the same time.","status":"published","published":"2021-08-25T20:48:07Z","modified":"2023-06-13T20:48:28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2020-35882","description":"An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.","status":"published","published":"2020-12-31T10:15:16.207Z","modified":"2026-06-17T03:14:31.68Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35882","description":"An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.","status":"published","published":"2020-12-31T10:15:16.207Z","modified":"2026-10-24T10:30:19.737196315Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-8q2v-67v7-6vc6","title":"Data races in rocket","description":"The affected version of rocket contains a Clone trait implementation of LocalRequest that reuses the pointer to inner Request object. This causes data race in rare combinations of APIs if the original and the cloned objects are modified at the same time.","status":"published","published":"2021-08-25T20:48:07Z","modified":"2023-11-08T04:03:37.315505Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"RUSTSEC-2020-0028","title":"`LocalRequest::clone` creates multiple mutable references to the same object","description":"The affected version of `rocket` contains a `Clone` trait implementation of\n`LocalRequest` that reuses the pointer to inner `Request` object.\nThis causes data race in rare combinations of APIs if the original and the\ncloned objects are modified at the same time.","status":"published","published":"2020-05-27T12:00:00Z","modified":"2023-11-08T04:03:37.315505Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}