CVE-2020-35928

Name of the Vulnerable Software and Affected Versions concread crate versions prior to 0.2.6

Description An issue in the concread crate allows attackers to cause an ARCache<K,V> data race by sending types that do not implement Send/Sync. The affected versions unconditionally implemented Send/Sync traits for the ARCache<K, V> type, enabling users to send or access types that do not implement Send/Sync, which can cause a data race.

Recommendations For concread crate versions prior to 0.2.6, update to version 0.2.6 or later, which adds bounds K: Send + Sync & V: Send + Sync to the affected Send/Sync trait implementations, correcting the flaw.