Delegate functions are missing `Send` boundGHSA-x4mq-m75f-mx8m
CRITICALFix: microsoft/windows-rs@afe3252GHSA-x4mq-m75f-mx8m is a critical-severity (CVSS 9.8) vulnerability in windows. A fix is available for windows — see the affected versions and patch details below.
Real-World Exposure
windowsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Affected versions of this crate did not require event handlers to have Send bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior.
The flaw was corrected in commit afe3252 by adding Send bounds.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | windows | ≥ 0.1.2&&< 0.32.0 | 0.32.0cargo update -p windows --precise 0.32.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for windows, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update windows to 0.32.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x4mq-m75f-mx8m is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-x4mq-m75f-mx8m in your dependencies?
Find it across crates.io, including transitive dependencies.