CVE-2020-15254

Name of the Vulnerable Software and Affected Versions: crossbeam-channel versions prior to 0.4.4

Description: The issue is related to the bounded channel in the crossbeam-channel library, which incorrectly assumes that Vec::from iter allocates capacity equal to the number of iterator elements. However, Vec::from iter may allocate extra memory, leading to unsound deallocation with incorrect capacity when reconstructing Vec from a raw pointer. This can cause issues with memory management.

Recommendations: For versions prior to 0.4.4, upgrade to crossbeam-channel 0.4.4 to fix the issue. As a temporary workaround, consider avoiding the use of the bounded channel until the upgrade is possible.