{"id":"CVE-2020-35905","aliases":["EUVD-2022-5172","GHSA-rh4w-94hh-9943","RUSTSEC-2020-0059","openSUSE-SU-2024:11751-1"],"status":"published","title":"MutexGuard::map can cause a data race in safe code","description":"An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00264,"percentile":0.18426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2020-10-22T12:00:00Z","modified":"2026-10-24T10:30:24Z","fixes":[{"ecosystem":"crates.io","package":"futures-util","fixed_in":["0.3.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"futures-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.2"},{"fixed":"0.3.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"futures-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.2"},{"fixed":"0.3.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"futures-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.2"},{"fixed":"0.3.7"}]}]}],"products":[{"vendor":"rust-lang","product":"future-utils"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0059.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35905","tags":["advisory"]},{"url":"https://github.com/rust-lang/futures-rs/issues/2239","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-rh4w-94hh-9943"},{"url":"https://github.com/rust-lang/futures-rs","tags":["package"]},{"url":"https://crates.io/crates/futures-util","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45710","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-35905","description":"An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).","status":"published","published":"2020-12-31T08:21:25Z","modified":"2024-08-04T17:16:13.203Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2022-5172","description":"An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).","status":"published","published":"2020-12-31T08:21:25Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-rh4w-94hh-9943","title":"MutexGuard::map can cause a data race in safe code","description":"Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.\n\nThis could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.\n\nThe issue was fixed by fixing Send and Sync implementations, and by adding a PhantomData\u003c\u0026'a mut U\u003e marker to the MappedMutexGuard type to tell the compiler that the guard is over U too.","status":"published","published":"2022-05-24T17:37:49Z","modified":"2023-06-13T17:24:14Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2020-35905","description":"An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).","status":"published","published":"2020-12-31T09:15:15.13Z","modified":"2026-06-17T03:14:34.617Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35905","description":"An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).","status":"published","published":"2020-12-31T09:15:15.13Z","modified":"2026-10-24T10:30:24.429075334Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-rh4w-94hh-9943","title":"MutexGuard::map can cause a data race in safe code","description":"Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.\n\nThis could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.\n\nThe issue was fixed by fixing Send and Sync implementations, and by adding a PhantomData\u003c\u0026'a mut U\u003e marker to the MappedMutexGuard type to tell the compiler that the guard is over U too.","status":"published","published":"2022-05-24T17:37:49Z","modified":"2023-11-08T04:03:38.548968Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"RUSTSEC-2020-0059","title":"MutexGuard::map can cause a data race in safe code","description":"Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.\n\nThis could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.\n\nThe issue was fixed by fixing `Send` and `Sync` implementations, and by adding a `PhantomData\u003c\u0026'a mut U\u003e` marker to the `MappedMutexGuard` type to tell the compiler that the guard is over\nU too.","status":"published","published":"2020-10-22T12:00:00Z","modified":"2023-11-08T04:03:38.548968Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"openSUSE-SU-2024:11751-1","title":"afterburn-5.0.0-6.1 on GA media","description":"These are all security issues fixed in the afterburn-5.0.0-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:02.541488Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}