CVE-2020-35886

MEDIUM

arr < 2020-08-25 - Data Race via Non-Sync/Send Type Smuggling

Title source: llm

Description

An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://rustsec.org/advisories/RUSTSEC-2020-0034.html

Scores

CVSS v3 4.7

EPSS 0.0019

EPSS Percentile 8.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-362

Status published

Products (2)

arr_project/arr < 2020-08-25

crates.io/arr 0crates.io

Published Dec 31, 2020

Tracked Since Feb 18, 2026