Read the docs
TI-2025-43631 Aliases GHSA-rr8g-9fpq-6wmg

Tokio broadcast channel calls clone in parallel, but does not require `Sync`

Priority LOW 38CWE-664Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The broadcast channel internally calls `clone` on the stored value when receiving it, and only requires `T:Send`. This means that using the broadcast channel with values that are `Send` but not `Sync` can trigger unsoundness if the `clone` implementation makes use of the value being `!Sync`. Thank you to Austin Bonander for finding and reporting this issue.

Why it matters now

Fix Fixed tokio (crates.io): 1.44.2, 1.38.2, 1.43.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—tokio (crates.io)1.44.0 to before 1.44.21.44.2Patch availableGHSA-rr8g-9fpq-6wmg
—tokio (crates.io)0.2.5 to before 1.38.21.38.2Patch availableGHSA-rr8g-9fpq-6wmg
—tokio (crates.io)1.39.0 to before 1.43.11.43.1Patch availableGHSA-rr8g-9fpq-6wmg
  • tokio (crates.io) Vendor— Affected 1.44.0 to before 1.44.2 Fixed in 1.44.2 Patch available GHSA-rr8g-9fpq-6wmg
  • tokio (crates.io) Vendor— Affected 0.2.5 to before 1.38.2 Fixed in 1.38.2 Patch available GHSA-rr8g-9fpq-6wmg
  • tokio (crates.io) Vendor— Affected 1.39.0 to before 1.43.1 Fixed in 1.43.1 Patch available GHSA-rr8g-9fpq-6wmg

Remediation

  • Fix · GHSA-rr8g-9fpq-6wmg tokio (crates.io) Fixed in 1.44.2 Advisory →
  • Fix · GHSA-rr8g-9fpq-6wmg tokio (crates.io) Fixed in 1.38.2 Advisory →
  • Fix · GHSA-rr8g-9fpq-6wmg tokio (crates.io) Fixed in 1.43.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-rr8g-9fpq-6wmg

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences