{"id":"RUSTSEC-2026-0244","title":"`setlocale` and `TextDomain::init` are unsound as they access environment with no synchronization","summary":"`setlocale` and `TextDomain::init` are unsound as they access environment with no synchronization","severity":"none","vendor":"gettext-rs","product":"gettext-rs","ecosystem":"rust","affected":["gettext-rs >= 0.0.0-0, < 0.8.0"],"patched":["gettext-rs 0.8.0"],"published":"2026-08-06","updated":"2026-08-09","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0244","references":[{"url":"https://crates.io/crates/gettext-rs"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0244.html"},{"url":"https://github.com/gettext-rs/gettext-rs/issues/64"}],"tags":["osv","rust"],"ingestedAt":"2026-08-09T19:16:06.293Z","slug":"RUSTSEC-2026-0244","body":"## Overview\n\n`setlocale` and `TextDomain::init` are unsound and may allow safe code to exhibit undefined behavior when called in a multi-threaded program.\n\nThe flaw is fixed in 0.8.0 by marking these functions `unsafe` and documenting the conditions under which they can be called safely.\n\n## Affected packages\n\n- `gettext-rs >= 0.0.0-0, < 0.8.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gettext-rs 0.8.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}