{"id":"CVE-2020-35908","aliases":["EUVD-2022-2648","GHSA-5r9g-j7jj-hw6c","RUSTSEC-2020-0062"],"status":"published","title":"Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00341,"percentile":0.27752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-01-24T12:00:00Z","modified":"2026-10-24T10:30:17Z","fixes":[{"ecosystem":"crates.io","package":"futures-util","fixed_in":["0.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"futures-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"futures-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"futures-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]}],"products":[{"vendor":"rust-lang","product":"future-utils"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0062.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35908","tags":["advisory"]},{"url":"https://github.com/rust-lang/futures-rs/issues/2050","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-5r9g-j7jj-hw6c"},{"url":"https://github.com/rust-lang/futures-rs","tags":["package"]},{"url":"https://crates.io/crates/futures-util","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35908","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","status":"published","published":"2020-12-31T08:20:46Z","modified":"2024-08-04T17:16:13.153Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2022-2648","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","status":"published","published":"2020-12-31T08:20:46Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-5r9g-j7jj-hw6c","title":"Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","status":"published","published":"2022-05-24T17:37:49Z","modified":"2023-06-22T05:03:12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T14:36:55.184601Z"}],"nvd":[{"id":"CVE-2020-35908","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","status":"published","published":"2020-12-31T09:15:15.287Z","modified":"2026-06-17T03:14:34.99Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35908","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","status":"published","published":"2020-12-31T09:15:15.287Z","modified":"2026-10-24T10:30:17.512608808Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-5r9g-j7jj-hw6c","title":"Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption","description":"An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.","status":"published","published":"2022-05-24T17:37:49Z","modified":"2023-11-08T04:03:38.733785Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RUSTSEC-2020-0062","title":"Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption","description":"Affected versions of the crate had an unsound `Sync` implementation on the `FuturesUnordered` structure, which used a `Cell` for\ninterior mutability without any code to handle synchronized access to the underlying task list's length and head safely.\n\nThis could of lead to data corruption since two threads modifying the list at once could see incorrect values due to the lack\nof access synchronization.\n\nThe issue was fixed by adding access synchronization code around insertion of tasks into the list.","status":"published","published":"2020-01-24T12:00:00Z","modified":"2023-11-08T04:03:38.733785Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}