{"id":"CVE-2020-36441","aliases":["EUVD-2021-1855","GHSA-r626-fc64-3q28","RUSTSEC-2020-0121"],"status":"published","title":"Data race in abox","description":"An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox\u003cT\u003e with no requirement for T: Send and T: Sync.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00766,"percentile":0.55902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-362"],"published":"2020-11-10T12:00:00Z","modified":"2026-06-17T03:15:29Z","fixes":[{"ecosystem":"crates.io","package":"abox","fixed_in":["0.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"abox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"abox","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"abox","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.1"}]}]}],"products":[{"vendor":"abox_project","product":"abox"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0121.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36441","tags":["advisory"]},{"url":"https://github.com/SonicFrog/abox/issues/1","tags":["web","report"]},{"url":"https://github.com/SonicFrog/abox/pull/2","tags":["web"]},{"url":"https://github.com/SonicFrog/abox/commit/34c2b9e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r626-fc64-3q28"},{"url":"https://github.com/SonicFrog/abox","tags":["package"]},{"url":"https://crates.io/crates/abox","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-36441","description":"An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox\u003cT\u003e with no requirement for T: Send and T: Sync.","status":"published","published":"2021-08-08T05:17:56Z","modified":"2024-08-04T17:30:08.273Z","updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2021-1855","description":"An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox\u003cT\u003e with no requirement for T: Send and T: Sync.","status":"published","published":"2021-08-08T05:17:56Z","modified":"2024-08-04T17:30:08Z","updated_at":"2026-11-03T03:07:02.510914Z"}],"ghsa":[{"id":"GHSA-r626-fc64-3q28","title":"Data race in abox","description":"Affected versions of this crate implements `Send`/`Sync` for `AtomicBox\u003cT\u003e` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox\u003cT\u003e` and trait bound `T: Sync` to `Sync` impl for `AtomicBox\u003cT\u003e`.","status":"published","published":"2021-08-25T20:59:06Z","modified":"2023-06-13T22:20:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-362"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2020-36441","description":"An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox\u003cT\u003e with no requirement for T: Send and T: Sync.","status":"published","published":"2021-08-08T06:15:07.167Z","modified":"2026-06-17T03:15:29.94Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:06:44.292752Z"}],"osv":[{"id":"GHSA-r626-fc64-3q28","title":"Data race in abox","description":"Affected versions of this crate implements `Send`/`Sync` for `AtomicBox\u003cT\u003e` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox\u003cT\u003e` and trait bound `T: Sync` to `Sync` impl for `AtomicBox\u003cT\u003e`.","status":"published","published":"2021-08-25T20:59:06Z","modified":"2023-11-08T04:03:45.02484Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-362"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RUSTSEC-2020-0121","title":"AtomicBox\u003cT\u003e implements Send/Sync for any `T: Sized`","description":"Affected versions of this crate implements `Send`/`Sync` for `AtomicBox\u003cT\u003e` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread.\n\nSuch behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race).\n\nThe flaw was corrected in commit 34c2b9e by adding trait bound `T: Send` to `Send` impl for `AtomicBox\u003cT\u003e` and trait bound `T: Sync` to `Sync` impl for `AtomicBox\u003cT\u003e`.","status":"published","published":"2020-11-10T12:00:00Z","modified":"2023-11-08T04:03:45.02484Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}