{"id":"CVE-2021-45704","aliases":["EUVD-2022-0570","GHSA-3hxh-7jxm-59x4","GHSA-cwvc-87xq-pc5m","RUSTSEC-2021-0113"],"status":"published","title":"AtomicBucket\u003cT\u003e unconditionally implements Send/Sync","description":"An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket\u003cT\u003e unconditionally implements the Send and Sync traits.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00766,"percentile":0.55782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-787"],"published":"2021-04-07T12:00:00Z","modified":"2026-06-17T04:13:59Z","fixes":[{"ecosystem":"crates.io","package":"metrics-util","fixed_in":["0.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"metrics-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"metrics-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"metrics-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"metrics-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"metrics-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.0"}]}]}],"products":[{"vendor":"metrics-util_project","product":"metrics-util"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0113.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/metrics-util/RUSTSEC-2021-0113.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/metrics-rs/metrics/issues/190","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-3hxh-7jxm-59x4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45704","tags":["advisory"]},{"url":"https://github.com/metrics-rs/metrics/commit/8e6daab","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cwvc-87xq-pc5m"},{"url":"https://github.com/metrics-rs/metrics","tags":["package"]},{"url":"https://crates.io/crates/metrics-util","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-45704","description":"An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket\u003cT\u003e unconditionally implements the Send and Sync traits.","status":"published","published":"2021-12-26T21:48:33Z","modified":"2024-08-04T04:47:02.02Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2022-0570","description":"An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket\u003cT\u003e unconditionally implements the Send and Sync traits.","status":"published","published":"2021-12-26T21:48:33Z","modified":"2024-08-04T04:47:02Z","updated_at":"2026-11-03T03:08:25.77408Z"}],"ghsa":[{"id":"GHSA-cwvc-87xq-pc5m","title":"Out-of-bounds Write and Race Condition in metrics-util","description":"In the affected versions of the crate, AtomicBucket\u003cT\u003e unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner T: !Sync by using the AtomicBucket::data_with() API. Such data races can potentially cause memory corruption or other undefined behavior.\n\nThe flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block\u003cT\u003e (which is a data type contained inside AtomicBucket\u003cT\u003e).","status":"published","published":"2022-01-06T22:08:43Z","modified":"2023-06-13T18:14:16Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362","CWE-787"],"updated_at":"2026-11-02T14:36:53.654352Z"},{"id":"GHSA-3hxh-7jxm-59x4","title":"AtomicBucket\u003cT\u003e unconditionally implements Send/Sync","description":"In the affected versions of the crate, `AtomicBucket\u003cT\u003e` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner\n`T: !Sync` by using the `AtomicBucket::data_with()` API.\nSuch data races can potentially cause memory corruption or other undefined behavior.\n\nThe flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block\u003cT\u003e` (which is a data type contained inside `AtomicBucket\u003cT\u003e`).\n","status":"published","published":"2022-06-17T00:13:03Z","modified":"2023-01-12T05:01:02Z","updated_at":"2026-11-02T14:36:13.23016Z"}],"nvd":[{"id":"CVE-2021-45704","description":"An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket\u003cT\u003e unconditionally implements the Send and Sync traits.","status":"published","published":"2021-12-27T00:15:09.817Z","modified":"2026-06-17T04:13:59.03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362","CWE-787"],"updated_at":"2026-11-02T14:07:02.977492Z"}],"osv":[{"id":"GHSA-cwvc-87xq-pc5m","title":"Out-of-bounds Write and Race Condition in metrics-util","description":"In the affected versions of the crate, AtomicBucket\u003cT\u003e unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner T: !Sync by using the AtomicBucket::data_with() API. Such data races can potentially cause memory corruption or other undefined behavior.\n\nThe flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block\u003cT\u003e (which is a data type contained inside AtomicBucket\u003cT\u003e).","status":"published","published":"2022-01-06T22:08:43Z","modified":"2023-11-08T04:07:22.868706Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362","CWE-787"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"GHSA-3hxh-7jxm-59x4","title":"AtomicBucket\u003cT\u003e unconditionally implements Send/Sync","description":"In the affected versions of the crate, `AtomicBucket\u003cT\u003e` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner\n`T: !Sync` by using the `AtomicBucket::data_with()` API.\nSuch data races can potentially cause memory corruption or other undefined behavior.\n\nThe flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block\u003cT\u003e` (which is a data type contained inside `AtomicBucket\u003cT\u003e`).\n","status":"published","published":"2022-06-17T00:13:03Z","modified":"2023-11-08T04:07:22.868706Z","updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RUSTSEC-2021-0113","title":"AtomicBucket\u003cT\u003e unconditionally implements Send/Sync","description":"In the affected versions of the crate, `AtomicBucket\u003cT\u003e` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner\n`T: !Sync` by using the `AtomicBucket::data_with()` API.\nSuch data races can potentially cause memory corruption or other undefined behavior.\n\nThe flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block\u003cT\u003e` (which is a data type contained inside `AtomicBucket\u003cT\u003e`).","status":"published","published":"2021-04-07T12:00:00Z","modified":"2023-11-08T04:07:22.868706Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}