CVE-2020-36216

Name of the Vulnerable Software and Affected Versions eventio crate versions prior to 0.5.1

Description An issue in the eventio crate allows a non-Send type to be sent to a different thread, potentially causing a data race and memory corruption. This occurs because Input<R> implements Send without requiring R: Send, leading to undefined behavior when non-Send types are sent to other threads.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later, which includes the R: Send bound to the Send impl of Input<R>, correcting the flaw.