GHSA-jwph-qp5h-f9wj
Data races in bunch
Details
An issue was discovered in the bunch crate through 2020-11-12 for Rust. Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch<T>`. This allows users to insert `T: !Sync` to `Bunch<T>`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch<T>` and sending `Bunch<T>` to another thread, allowing to create a data race by inserting types like `T = Rc<_>`.
Such data races can lead to memory corruption.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for bunch. Pin to a known-safe version or switch to an alternative.