{"id":"CVE-2020-35898","aliases":["EUVD-2021-1747","GHSA-hhw2-pqhf-vmx2","RUSTSEC-2020-0045"],"status":"published","title":"Use after free in actix-utils","description":"An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01428,"percentile":0.73172,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2020-01-08T12:00:00Z","modified":"2026-06-17T03:14:33Z","fixes":[{"ecosystem":"crates.io","package":"actix-utils","fixed_in":["2.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"actix-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"actix-utils","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"actix-utils","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.0.0"}]}]}],"products":[{"vendor":"actix","product":"actix-utils"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0045.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35898","tags":["advisory"]},{"url":"https://github.com/actix/actix-net/issues/160","tags":["web","report"]},{"url":"https://github.com/actix/actix-net/commit/0dca1a705ad1ff4885b3491ecb809a808e1de66c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhw2-pqhf-vmx2"},{"url":"https://github.com/actix/actix-net","tags":["package"]},{"url":"https://crates.io/crates/actix-utils","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35898","description":"An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.","status":"published","published":"2020-12-31T08:23:03Z","modified":"2024-08-04T17:16:13.213Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2021-1747","description":"An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.","status":"published","published":"2020-12-31T08:23:03Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-hhw2-pqhf-vmx2","title":"Use after free in actix-utils","description":"An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.","status":"published","published":"2021-08-25T20:49:09Z","modified":"2025-05-23T18:29:58Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:38:43.998596Z"}],"nvd":[{"id":"CVE-2020-35898","description":"An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.","status":"published","published":"2020-12-31T09:15:14.647Z","modified":"2026-06-17T03:14:33.767Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"GHSA-hhw2-pqhf-vmx2","title":"Use after free in actix-utils","description":"An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.","status":"published","published":"2021-08-25T20:49:09Z","modified":"2025-05-23T18:29:56Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"RUSTSEC-2020-0045","title":"bespoke Cell implementation allows obtaining several mutable references to the same data","description":"The custom implementation of a Cell primitive in the affected versions of this crate\ndoes not keep track of mutable references to the underlying data.\n\nThis allows obtaining several mutable references to the same object\nwhich may result in arbitrary memory corruption, most likely use-after-free.\n\nThe flaw was corrected by switching from a bespoke `Cell\u003cT\u003e` implementation to `Rc\u003cRefCell\u003cT\u003e\u003e`.","status":"published","published":"2020-01-08T12:00:00Z","modified":"2023-11-08T04:03:38.175676Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}