GHSA-w443-5h3j-jqcp
Duplicate Advisory: crossbeam-channel Vulnerable to Double Free on Drop
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-415 Double Free
- Fix
0.5.15- Upgrade crossbeam-channel to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pg9f-39pc-qf8g. This link is maintained to preserve external references.
Original Description
In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| crossbeam-channel | >= 0.5.11, < 0.5.15 |
0.5.15 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
crossbeam-channel crates.io → 0.5.15
- cargo
cargo update -p crossbeam-channel --precise 0.5.15
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Weakness
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Implementation: Use a static analysis tool to find double free instances.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Withdrawn
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pg9f-39pc-qf8g crossbeam-channel Vulnerable to Double Free on Drop | Medium | Also affects crossbeam-channel |
| GHSA-9g55-pg62-m8hh Channel creates zero value of any type | High | Also affects crossbeam-channel |
| GHSA-m8h8-v6jh-c762 Incorrect buffer size in crossbeam-channel | Medium | Also affects crossbeam-channel |
| GO-2026-4981 Crash when handling long CNAME response in net | High | Same weakness, CWE-415 |
| GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution | Medium | Same weakness, CWE-415 |
| CVE-2026-33824 Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. | Critical Known exploited | Same weakness, CWE-415 |
| CVE-2025-62215 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate… | High Known exploited | Same weakness, CWE-415 |
| GHSA-7mcq-f592-pf7v Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs | High | Same weakness, CWE-415 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor