{"id":"CVE-2020-36219","aliases":["EUVD-2021-1638","GHSA-8gf5-q9p9-wvmc","RUSTSEC-2020-0113"],"status":"published","title":"Data race in atomic-option","description":"An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption\u003cT\u003e implements Sync unconditionally, a data race can occur.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01121,"percentile":0.66459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-662"],"published":"2020-10-31T12:00:00Z","modified":"2026-06-17T03:15:07Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"atomic-option","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"atomic-option","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.1.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"atomic-option","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"products":[{"vendor":"atomic-option_project","product":"atomic-option"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0113.html","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36219","tags":["advisory"]},{"url":"https://github.com/reem/rust-atomic-option/issues/4","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-8gf5-q9p9-wvmc"},{"url":"https://github.com/reem/rust-atomic-option","tags":["package"]},{"url":"https://crates.io/crates/atomic-option","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-36219","description":"An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption\u003cT\u003e implements Sync unconditionally, a data race can occur.","status":"published","published":"2021-01-22T09:04:00Z","modified":"2024-08-04T17:23:09.58Z","updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2021-1638","description":"An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption\u003cT\u003e implements Sync unconditionally, a data race can occur.","status":"published","published":"2021-01-22T09:04:00Z","modified":"2024-08-04T17:23:09Z","updated_at":"2026-11-03T03:07:03.484914Z"}],"ghsa":[{"id":"GHSA-8gf5-q9p9-wvmc","title":"Data race in atomic-option","description":"An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption\u003cT\u003e implements Sync unconditionally, a data race can occur.","status":"published","published":"2021-08-25T20:51:42Z","modified":"2023-02-01T05:05:56Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-662"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2020-36219","description":"An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption\u003cT\u003e implements Sync unconditionally, a data race can occur.","status":"published","published":"2021-01-26T18:15:56.567Z","modified":"2026-06-17T03:15:07.82Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"GHSA-8gf5-q9p9-wvmc","title":"Data race in atomic-option","description":"An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption\u003cT\u003e implements Sync unconditionally, a data race can occur.","status":"published","published":"2021-08-25T20:51:42Z","modified":"2023-11-08T04:03:42.214536Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-662"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"RUSTSEC-2020-0113","title":"AtomicOption should have Send + Sync bound on its type argument.","description":"In the affected versions of this crate,\n`AtomicOption\u003cT\u003e` unconditionally implements `Sync`.\n\nThis allows programmers to move non-Sync types across thread boundaries (e.g. `Rc\u003cT\u003e`, `Arc\u003cCell\u003cT\u003e\u003e`), which can lead to data races and undefined behavior. \nIt is also possible to send non-Send types like `std::sync::MutexGuard` to other threads, which can lead to undefined behavior.","status":"published","published":"2020-10-31T12:00:00Z","modified":"2023-11-08T04:03:42.214536Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}