lockfree

Activity

Latest release: 7y ago
Total releases: 11
Cadence: ~3 days
Last 12 months: 0

Details

License: MIT
First release: Jun 15, 2018

Releases

Version	Released
`0.5.1` unknown 1 CVE	Nov 18, 2018
`0.5.0` unknown 1 CVE	Nov 17, 2018
`0.4.1` unknown 1 CVE	Nov 11, 2018
`0.4.0` unknown 1 CVE	Nov 11, 2018
`0.3.2` unknown 1 CVE	Nov 04, 2018
`0.3.1` unknown 1 CVE	Nov 04, 2018
`0.3.0` unknown 1 CVE	Nov 02, 2018
`0.2.0` unknown 1 CVE	Sep 18, 2018
`0.1.2` unknown 1 CVE	Jul 08, 2018
`0.1.1` unknown 1 CVE	Jun 15, 2018
`0.1.0` unknown 1 CVE	Jun 15, 2018

Dependencies (1)

Depends on

0.5.1

Used by

Supply-chain exposure

41 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

1 of 1

owned-alloc 2 CVEs

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

RUSTSEC-2026-0284 Aug 26, 2026

Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

Two independent soundness problems, both reachable from safe Rust.

Map::into_iter drops builder (the caller-supplied hasher H) and incin by hand, then commits the ownership transfer with mem::forget(self). H::drop is user code and may panic. If it does, mem::forget(self) is skipped and the still-live Map unwinds, whose field drop glue destroys builder a second time. An empty map is enough — no entries or concurrency required.

SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into self.inner before taking the real Arc out. Arc has a validity invariant, so this is undefined behaviour at the point of creation, with no panic or concurrency involved. Between that write and the repairing one, self.inner also holds garbage while self is still droppable, so an unwind from incin.clear() or Arc::new decrements a refcount through an uninitialized pointer. The make_shared_incin! macro is instantiated five times, so this covers queue, stack, map, channel::spmc and channel::mpmc.

Impact

CWE-415 (Double Free): the same allocation is freed twice.

CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated Drop.

CWE-908 (Use of Uninitialized Resource): an Arc is constructed from uninitialized bytes.

Fix

No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.

References

https://crates.io/crates/lockfree
https://rustsec.org/advisories/RUSTSEC-2026-0284.html
https://gitlab.com/bzim/lockfree/-/issues/7

Updated Sep 14, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

unknown 11

11 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More