CVE-2020-35902

Name of the Vulnerable Software and Affected Versions actix-codec crate versions prior to 0.3.0-beta.1

Description The issue is related to a use-after-free in Framed, where affected versions of the crate did not require the buffer wrapped in Framed to be pinned, but treated it as if it had a fixed location in memory. This may result in a use-after-free.

Recommendations For actix-codec crate versions prior to 0.3.0-beta.1, update to version 0.3.0-beta.1 or later, which corrected the flaw by making the affected functions accept Pin<&mut Self> instead of &mut self.