/
DirectorySecurity Advisories
Sign In
Security Advisories

CGA-864p-hqmm-2hc8

Published

Last updated

https://images.chainguard.dev/security/CGA-864p-hqmm-2hc8
Package

helix

RepositoryWolfi
Latest Update
Fixed
Fixed Version

25.01.1-r1

Aliases
  • GHSA-rr8g-9fpq-6wmg

Severity

Unknown

Summary

Tokio broadcast channel calls clone in parallel, but does not require Sync

Description

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Products

Chainguard ContainersChainguard LibrariesChainguard VMs