---
id: RUSTSEC-2026-0221
title: >-
  `event-listener` allows `!Send` tags to cross thread boundaries via
  `StackSlot`
summary: >-
  `event-listener` allows `!Send` tags to cross thread boundaries via
  `StackSlot`
severity: none
vendor: event-listener
product: event-listener
ecosystem: rust
affected:
  - 'event-listener >= 5.1.0, < 5.4.2'
patched:
  - event-listener 5.4.2
published: '2026-07-13'
updated: '2026-07-31'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0221'
references:
  - url: 'https://crates.io/crates/event-listener'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0221.html'
  - url: 'https://github.com/smol-rs/event-listener/pull/163'
tags:
  - osv
  - rust
ingestedAt: '2026-07-31T19:10:08.285Z'
---

## Overview

Affected versions of `event-listener` unconditionally implement `Send` and
`Sync` for `StackSlot<'_, T>`, the stack-allocated listener type created
by the `listener!` macro.

This allows a `!Send` tag type set via `Event::with_tag` to be moved to
another thread and accessed via `StackSlot::wait`, causing a data race in safe
code.

## Affected packages

- `event-listener >= 5.1.0, < 5.4.2`

## Remediation

Upgrade to a patched release:

- `event-listener 5.4.2`