{"id":"GHSA-rr8g-9fpq-6wmg","aliases":["RUSTSEC-2025-0023"],"url":"https://o3.security/vulnerability/GHSA-rr8g-9fpq-6wmg","summary":"Tokio broadcast channel calls clone in parallel, but does not require `Sync`","details":"The broadcast channel internally calls `clone` on the stored value when receiving it, and only requires `T:Send`. This means that using the broadcast channel with values that are `Send` but not `Sync` can trigger unsoundness if the `clone` implementation makes use of the value being `!Sync`.\n\nThank you to Austin Bonander for finding and reporting this issue.","published":"2025-04-07T21:12:50Z","modified":"2026-09-10T03:50:24.081979053Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"tokio","fixedVersion":"1.44.2"},{"ecosystem":"crates.io","name":"tokio","fixedVersion":"1.38.2"},{"ecosystem":"crates.io","name":"tokio","fixedVersion":"1.43.1"}],"fix":{"url":"https://github.com/tokio-rs/tokio/pull/7232","label":"tokio-rs/tokio#7232"},"references":[{"type":"WEB","url":"https://github.com/tokio-rs/tokio/pull/7232"},{"type":"PACKAGE","url":"https://github.com/tokio-rs/tokio"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0023.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:24.081979053Z"}}