{"id":"CVE-2020-36447","aliases":["EUVD-2021-1536","GHSA-3837-87vh-xq3w","GHSA-pfjq-935c-4895","RUSTSEC-2020-0127"],"status":"published","title":"Data race in v9","description":"An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef\u003cT\u003e.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01059,"percentile":0.64939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-77"],"published":"2020-12-18T12:00:00Z","modified":"2026-06-17T03:15:30Z","fixes":[{"ecosystem":"crates.io","package":"v9","fixed_in":["0.1.43"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"v9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.43"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"v9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.43"}]}]},{"source":"osv","ecosystem":"crates.io","package":"v9","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.43"}]}]},{"source":"osv","ecosystem":"crates.io","package":"v9","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.43"}]}]},{"source":"osv","ecosystem":"crates.io","package":"v9","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.1.43"}]}]}],"products":[{"vendor":"v9_project","product":"v9"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0127.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/v9/RUSTSEC-2020-0127.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36447","tags":["advisory"]},{"url":"https://github.com/purpleposeidon/v9/issues/1","tags":["web","report"]},{"url":"https://github.com/purpleposeidon/v9/commit/18847c50e5d36561cc91c996c3539ddb1eacf6c7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3837-87vh-xq3w"},{"url":"https://github.com/advisories/GHSA-pfjq-935c-4895"},{"url":"https://github.com/purpleposeidon/v9","tags":["package"]},{"url":"https://crates.io/crates/v9","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-36447","description":"An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef\u003cT\u003e.","status":"published","published":"2021-08-08T05:16:37Z","modified":"2024-08-04T17:30:08.329Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2021-1536","description":"An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef\u003cT\u003e.","status":"published","published":"2021-08-08T05:16:37Z","modified":"2024-08-04T17:30:08Z","updated_at":"2026-11-03T03:07:03.010139Z"}],"ghsa":[{"id":"GHSA-3837-87vh-xq3w","title":"Data race in v9","description":"Affected versions of this crate unconditionally implement Sync for SyncRef\u003cT\u003e. This definition allows data races if \u0026T is accessible through \u0026SyncRef.\n\nSyncRef\u003cT\u003e derives Clone and Debug, and the default implementations of those traits access \u0026T by invoking T::clone() \u0026 T::fmt(). It is possible to create data races \u0026 undefined behavior by concurrently invoking SyncRef\u003cT\u003e::clone() or SyncRef\u003cT\u003e::fmt() from multiple threads with T: !Sync.","status":"published","published":"2021-08-25T20:57:07Z","modified":"2023-06-13T22:35:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:54.225318Z"},{"id":"GHSA-pfjq-935c-4895","title":"Data races in v9","description":"Affected versions of this crate unconditionally implement `Sync` for `SyncRef\u003cT\u003e`. This definition allows data races if `\u0026T` is accessible through `\u0026SyncRef`.\n\n`SyncRef\u003cT\u003e` derives `Clone` and `Debug`, and the default implementations of those traits access `\u0026T` by invoking `T::clone()` \u0026 `T::fmt()`. It is possible to create data races \u0026 undefined behavior by concurrently invoking `SyncRef\u003cT\u003e::clone()` or `SyncRef\u003cT\u003e::fmt()` from multiple threads with `T: !Sync`.\n","status":"published","published":"2021-08-25T21:00:37Z","modified":"2023-06-13T22:27:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2020-36447","description":"An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef\u003cT\u003e.","status":"published","published":"2021-08-08T06:15:07.39Z","modified":"2026-06-17T03:15:30.697Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:06:44.292752Z"}],"osv":[{"id":"GHSA-3837-87vh-xq3w","title":"Data race in v9","description":"Affected versions of this crate unconditionally implement Sync for SyncRef\u003cT\u003e. This definition allows data races if \u0026T is accessible through \u0026SyncRef.\n\nSyncRef\u003cT\u003e derives Clone and Debug, and the default implementations of those traits access \u0026T by invoking T::clone() \u0026 T::fmt(). It is possible to create data races \u0026 undefined behavior by concurrently invoking SyncRef\u003cT\u003e::clone() or SyncRef\u003cT\u003e::fmt() from multiple threads with T: !Sync.","status":"published","published":"2021-08-25T20:57:07Z","modified":"2023-11-08T04:03:45.399019Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"GHSA-pfjq-935c-4895","title":"Data races in v9","description":"Affected versions of this crate unconditionally implement `Sync` for `SyncRef\u003cT\u003e`. This definition allows data races if `\u0026T` is accessible through `\u0026SyncRef`.\n\n`SyncRef\u003cT\u003e` derives `Clone` and `Debug`, and the default implementations of those traits access `\u0026T` by invoking `T::clone()` \u0026 `T::fmt()`. It is possible to create data races \u0026 undefined behavior by concurrently invoking `SyncRef\u003cT\u003e::clone()` or `SyncRef\u003cT\u003e::fmt()` from multiple threads with `T: !Sync`.\n","status":"published","published":"2021-08-25T21:00:37Z","modified":"2023-11-08T04:03:45.399019Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RUSTSEC-2020-0127","title":"SyncRef's clone() and debug() allow data races","description":"Affected versions of this crate unconditionally implement `Sync` for `SyncRef\u003cT\u003e`.\nThis definition allows data races if `\u0026T` is accessible through `\u0026SyncRef`.\n\n`SyncRef\u003cT\u003e` derives `Clone` and `Debug`, and the default implementations of those traits access `\u0026T` by invoking `T::clone()` \u0026 `T::fmt()`. It is possible to create data races \u0026 undefined behavior by concurrently invoking `SyncRef\u003cT\u003e::clone()` or `SyncRef\u003cT\u003e::fmt()` from multiple threads with `T: !Sync`.","status":"published","published":"2020-12-18T12:00:00Z","modified":"2023-11-08T04:03:45.399019Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}