{"id":"RUSTSEC-2026-0221","title":"`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`","summary":"`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`","severity":"none","vendor":"event-listener","product":"event-listener","ecosystem":"rust","affected":["event-listener >= 5.1.0, < 5.4.2"],"patched":["event-listener 5.4.2"],"published":"2026-07-13","updated":"2026-07-31","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0221","references":[{"url":"https://crates.io/crates/event-listener"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0221.html"},{"url":"https://github.com/smol-rs/event-listener/pull/163"}],"tags":["osv","rust"],"ingestedAt":"2026-07-31T19:10:08.285Z","slug":"RUSTSEC-2026-0221","body":"## Overview\n\nAffected versions of `event-listener` unconditionally implement `Send` and\n`Sync` for `StackSlot<'_, T>`, the stack-allocated listener type created\nby the `listener!` macro.\n\nThis allows a `!Send` tag type set via `Event::with_tag` to be moved to\nanother thread and accessed via `StackSlot::wait`, causing a data race in safe\ncode.\n\n## Affected packages\n\n- `event-listener >= 5.1.0, < 5.4.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `event-listener 5.4.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}