GHSA-rr8g-9fpq-6wmg RUSTSEC-2025-0023

Tokio broadcast channel calls clone in parallel, but does not require `Sync`

Low crates.io

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-664 Improper Control of a Resource Through its Lifetime
Fix: 1.44.2; Upgrade tokio to this version or later

Description

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.

Affected versions

crates.io

Package	Vulnerable	Fixed in
tokio	`>= 1.44.0, < 1.44.2`	`1.44.2`
tokio	`>= 0.2.5, < 1.38.2`	`1.38.2`
tokio	`>= 1.39.0, < 1.43.1`	`1.43.1`
tokio	`>= 0.2.5, < 1.38.2` `>= 1.39.0, < 1.42.1` `>= 1.43.0, < 1.43.1` `>= 1.44.0, < 1.44.2`	`1.38.2` `1.42.1` `1.43.1` `1.44.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

tokio crates.io → `1.44.2`

cargo

cargo update -p tokio --precise 1.44.2

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Unreported

Weakness

CWE-664: Improper Control of a Resource Through its Lifetime

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

References

Packages

Timeline

Apr 7, 2025 Published
Sep 10, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-5wjr-9356-4wc8 Tokio: Race condition in `tokio::time::Interval`	Medium	Also affects tokio
RUSTSEC-2026-0386 `AsyncFd::new` and related constructors violate I/O safety	Not rated yet	Also affects tokio
GHSA-4q83-7cq4-p6wg `tokio::io::ReadHalf<T>::unsplit` is Unsound	Low	Also affects tokio
GHSA-7rrj-xr53-82p7 Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe	Medium	Also affects tokio
RUSTSEC-2021-0124 Race Condition in tokio	High	Also affects tokio
RUSTSEC-2021-0072 Race condition in tokio	Medium	Also affects tokio
GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state	Medium	Same weakness, CWE-664
CVE-2022-27518 Unauthenticated remote arbitrary code execution	Critical Known exploited	Same weakness, CWE-664

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor