Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/rust-crossbeam-channel@0.3.8-1
purl pkg:deb/debian/rust-crossbeam-channel@0.3.8-1
Next non-vulnerable version 0.4.4-1
Latest non-vulnerable version 0.4.4-1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-w377-ghca-5fff
Aliases:
CVE-2020-35904
GHSA-m8h8-v6jh-c762
Incorrect buffer size in crossbeam-channel The affected version of this crate's the bounded channel incorrectly assumes that Vec::from_iter has allocated capacity that same as the number of iterator elements. Vec::from_iter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::from_iter has allocated different sizes with the number of iterator elements.
0.4.4-1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-15T16:16:53.445073+00:00 Debian Oval Importer Affected by VCID-w377-ghca-5fff https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.4.0
2026-04-11T16:04:13.592051+00:00 Debian Oval Importer Affected by VCID-w377-ghca-5fff https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.3.0
2026-04-08T15:57:02.636647+00:00 Debian Oval Importer Affected by VCID-w377-ghca-5fff https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.1.0