CVE-2018-20996
highpriority · track · 40EPSS 0.017 · 78 %ileEUUSEPSS · scored 2026-10-28
An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-c3cw-c387-pj65Double free in crossbeam2021-08-25ghsa · osvUS
Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees. The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.
- RUSTSEC-2018-0009MsQueue and SegQueue suffer from double-free2018-12-09vendor · osvUS
Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees. The flaw was corrected by wrapping elements inside queues in a `ManuallyDrop`. Thanks to [@c0gent](https://github.com/c0gent) for reporting the issue.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan