-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| futures-util | rust | >= 0.3.0, < 0.3.2 | 0.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two related issues: 1) The Sync trait implementation for FuturesUnordered was invalid because it contained Cell fields (len and head_all) which are not thread-safe. 2) The push method modified these Cell-based fields without proper synchronization. Together these allowed concurrent unsynchronized access to internal state. The GitHub issue #2050 specifically identifies the Sync impl as incorrect after switching to Cell, and the advisory notes the lack of access synchronization during task insertion via push. The combination of improper Sync marking and unsynchronized mutations in push creates the data corruption vulnerability.