Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped. The flaw was corrected by adding 'static lifetime bound to the data waker takes.
Recommended action: Upgrade to 0.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of the crate used a UnsafeCell in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread. This resulted in a segmentation fault crash if Waker::wakebyref() was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn't accessible from the main thread.
Recommended action: Upgrade to 0.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.