{"id":"CVE-2020-35925","aliases":["EUVD-2021-1923","GHSA-wv4p-jp67-jr97","RUSTSEC-2020-0088"],"status":"published","title":"Data races in magnetic","description":"An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00382,"percentile":0.32487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2020-11-29T12:00:00Z","modified":"2026-06-17T03:14:37Z","fixes":[{"ecosystem":"crates.io","package":"magnetic","fixed_in":["2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"magnetic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"magnetic","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"magnetic","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.0.1"}]}]}],"products":[{"vendor":"magnetic_project","product":"magnetic"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0088.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35925","tags":["advisory"]},{"url":"https://github.com/johnshaw/magnetic/issues/9","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-wv4p-jp67-jr97"},{"url":"https://github.com/johnshaw/magnetic","tags":["package"]},{"url":"https://crates.io/crates/magnetic","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35925","description":"An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.","status":"published","published":"2020-12-31T08:16:44Z","modified":"2024-08-04T17:16:13.237Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2021-1923","description":"An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.","status":"published","published":"2020-12-31T08:16:44Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-wv4p-jp67-jr97","title":"Data races in magnetic","description":"Affected versions of this crate unconditionally implemented Sync and Send traits for MPMCConsumer and MPMCProducer types. This allows users to send types that do not implement Send trait across thread boundaries, which can cause a data race. The flaw was corrected in the 2.0.1 release by adding T: Send bound to affected Sync/Send trait implementations.","status":"published","published":"2021-08-25T20:50:05Z","modified":"2023-06-13T18:44:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2020-35925","description":"An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.","status":"published","published":"2020-12-31T09:15:16.333Z","modified":"2026-06-17T03:14:37.1Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"GHSA-wv4p-jp67-jr97","title":"Data races in magnetic","description":"Affected versions of this crate unconditionally implemented Sync and Send traits for MPMCConsumer and MPMCProducer types. This allows users to send types that do not implement Send trait across thread boundaries, which can cause a data race. The flaw was corrected in the 2.0.1 release by adding T: Send bound to affected Sync/Send trait implementations.","status":"published","published":"2021-08-25T20:50:05Z","modified":"2023-11-08T04:03:39.710071Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"RUSTSEC-2020-0088","title":"MPMCConsumer/Producer allows sending non-Send type across threads","description":"Affected versions of this crate unconditionally implemented `Sync` and `Send` traits for `MPMCConsumer` and `MPMCProducer` types.\n\nThis allows users to send types that do not implement `Send` trait across thread boundaries, which can cause a data race.\n\nThe flaw was corrected in the 2.0.1 release by adding `T: Send` bound to affected Sync/Send trait implementations.","status":"published","published":"2020-11-29T12:00:00Z","modified":"2023-11-08T04:03:39.710071Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}