RUSTSEC-2026-0221None▾ Sunlit`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Affected versions of event-listener unconditionally implement Send and
Sync for StackSlot<'_, T>, the stack-allocated listener type created
by the listener! macro.
This allows a !Send tag type set via Event::with_tag to be moved to
another thread and accessed via StackSlot::wait, causing a data race in safe
code.
event-listener >= 5.1.0, < 5.4.2Upgrade to a patched release:
event-listener 5.4.2