CVE-2025-47735:
wgp race condition in inner::drop
2.9
CVSS ScoreBasic Information
Technical Details
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
wgp | rust | <= 0.2.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability details explicitly mention 'inner::drop in inner.rs' and the GitHub issue (#1 for Nugine/wgp) provides a direct link to the vulnerable code block within src/inner.rs
at commit 90753e1fbb795b5da6ebfa988472e3382ad18b87
. The issue explains that the race condition is due to insufficient thread synchronization (fetch_sub
with Ordering::Release
followed by load
with Ordering::Acquire
) in the drop
implementation for the Inner<T>
struct. Although no fixing patch commit was provided, the vulnerable code and its location are clearly identified. The function name wgp::inner::Inner::drop
is derived from the crate name (wgp
), the module (inner.rs
), the struct name (Inner
), and the standard Rust Drop
trait method (drop
). The confidence is high due to the direct pointers and explanation in the issue report.