---
id: CVE-2018-20996
aliases:
  - RUSTSEC-2018-0009
  - GHSA-c3cw-c387-pj65
title: MsQueue and SegQueue suffer from double-free
summary: MsQueue and SegQueue suffer from double-free
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: crossbeam
product: crossbeam
ecosystem: rust
affected:
  - 'crossbeam >= 0.4.0, < 0.4.1'
patched:
  - crossbeam 0.4.1
published: '2018-12-09'
updated: '2026-07-17'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2018-0009'
references:
  - url: 'https://crates.io/crates/crossbeam'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2018-0009.html'
  - url: 'https://github.com/crossbeam-rs/crossbeam-epoch/issues/82'
tags:
  - osv
  - rust
epss: 0.01744
epssPercentile: 0.76777
ingestedAt: '2026-07-17T19:00:51.663Z'
---

## Overview

Even if an element is popped from a queue, crossbeam would run its
destructor inside the epoch-based garbage collector. This is a source
of double frees.

The flaw was corrected by wrapping elements inside queues in a
`ManuallyDrop`.

Thanks to [@c0gent](https://github.com/c0gent) for reporting the issue.

## Affected packages

- `crossbeam >= 0.4.0, < 0.4.1`

## Remediation

Upgrade to a patched release:

- `crossbeam 0.4.1`