{"id":"GHSA-2qv5-7mw5-j3cg","aliases":["RUSTSEC-2023-0031"],"status":"published","title":"spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers","description":"`Once::try_call_once` is unsound if invoked more than once concurrently and any call fails to initialise successfully.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-03-31T12:00:00Z","modified":"2026-09-10T03:49:53Z","fixes":[{"ecosystem":"crates.io","package":"spin","fixed_in":["0.9.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"spin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.3"},{"fixed":"0.9.8"}]}]},{"source":"osv","ecosystem":"crates.io","package":"spin","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.3"},{"fixed":"0.9.8"}]}]},{"source":"osv","ecosystem":"crates.io","package":"spin","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.3"},{"fixed":"0.9.8"}]}]}],"references":[{"url":"https://github.com/mvdnes/spin-rs/issues/148","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0031.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2qv5-7mw5-j3cg"},{"url":"https://github.com/mvdnes/spin-rs","tags":["package"]},{"url":"https://crates.io/crates/spin","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2qv5-7mw5-j3cg","title":"spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers","description":"`Once::try_call_once` is unsound if invoked more than once concurrently and any call fails to initialise successfully.\n","status":"published","published":"2023-04-03T22:53:18Z","modified":"2023-04-03T22:53:19Z","updated_at":"2026-11-02T14:36:49.768564Z"}],"osv":[{"id":"GHSA-2qv5-7mw5-j3cg","title":"spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers","description":"`Once::try_call_once` is unsound if invoked more than once concurrently and any call fails to initialise successfully.\n","status":"published","published":"2023-04-03T22:53:18Z","modified":"2026-09-10T03:49:53.155588159Z","updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"RUSTSEC-2023-0031","title":"Initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers","description":"`Once::try_call_once` is unsound if invoked more than once concurrently and any call fails to initialise successfully.","status":"published","published":"2023-03-31T12:00:00Z","modified":"2023-11-08T04:14:12.609447Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}