mio
Metal I/O library for Rust.
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 80
- Cadence
- ~2 months
- Last 12 months
- 6
Reach
- Stars
- 7.1k
Details
- License
- MIT
- First release
- Nov 11, 2014
| Version | Released | |
|---|---|---|
1.2.3
patch
| ||
1.2.2
unknown
| ||
1.2.1
unknown
| ||
1.2.0
unknown
| ||
1.1.1
unknown
| ||
1.1.0
unknown
| ||
1.0.4
unknown
| ||
1.0.3
unknown
| ||
1.0.2
unknown
| ||
1.0.1
unknown
| ||
1.0.0
unknown
| ||
0.8.11
unknown
| ||
0.8.10
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.9
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.8
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.7
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.6
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.5
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.4
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.3
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.2
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.1
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.8.0
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.14
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.13
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.12
unknown
yanked
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.11
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.10
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.9
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.8
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.7
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.6.23
unknown
|
0.6.23
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.7.6
unknown
1 CVE
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
0.7.5
unknown
yanked
2 CVEs
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2020-35922
GHSA-pf3p-x6qj-6j7q
RUSTSEC-2020-0081
Aug 25, 2021
mio invalidly assumes the memory layout of std::net::SocketAddr
5.5
/ 10
Medium
Local
Low
Low
None
Unchanged
None
None
High
The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens. Fixed in
0.7.6
References Updated Nov 08, 2023 · Source: OSV.dev | ||
0.7.4
unknown
yanked
2 CVEs
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2020-35922
GHSA-pf3p-x6qj-6j7q
RUSTSEC-2020-0081
Aug 25, 2021
mio invalidly assumes the memory layout of std::net::SocketAddr
5.5
/ 10
Medium
Local
Low
Low
None
Unchanged
None
None
High
The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens. Fixed in
0.7.6
References Updated Nov 08, 2023 · Source: OSV.dev | ||
0.7.3
unknown
yanked
2 CVEs
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2020-35922
GHSA-pf3p-x6qj-6j7q
RUSTSEC-2020-0081
Aug 25, 2021
mio invalidly assumes the memory layout of std::net::SocketAddr
5.5
/ 10
Medium
Local
Low
Low
None
Unchanged
None
None
High
The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens. Fixed in
0.7.6
References Updated Nov 08, 2023 · Source: OSV.dev | ||
0.7.2
unknown
yanked
2 CVEs
CVE-2024-27308
GHSA-r8w9-5wcg-vfj7
RUSTSEC-2024-0019
Mar 04, 2024
Mio's tokens for named pipes may be delivered after deregistration
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
ImpactWhen using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. Affected versionsThis vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. WorkaroundsVulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Technical detailsWhen an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered. This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369 This vulnerability was fixed in: tokio-rs/mio#1760 This vulnerability is also known as RUSTSEC-2024-0019. Thank you to @rofoun and @radekvit for discovering and reporting this issue. Fixed in
0.8.11
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2020-35922
GHSA-pf3p-x6qj-6j7q
RUSTSEC-2020-0081
Aug 25, 2021
mio invalidly assumes the memory layout of std::net::SocketAddr
5.5
/ 10
Medium
Local
Low
Low
None
Unchanged
None
None
High
The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens. Fixed in
0.7.6
References Updated Nov 08, 2023 · Source: OSV.dev | ||
0.7.1
unknown
yanked
1 CVE
CVE-2020-35922
GHSA-pf3p-x6qj-6j7q
RUSTSEC-2020-0081
Aug 25, 2021
mio invalidly assumes the memory layout of std::net::SocketAddr
5.5
/ 10
Medium
Local
Low
Low
None
Unchanged
None
None
High
The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens. Fixed in
0.7.6
References Updated Nov 08, 2023 · Source: OSV.dev | ||
0.6.22
unknown
|
0.6.22
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.7.0
unknown
yanked
1 CVE
CVE-2020-35922
GHSA-pf3p-x6qj-6j7q
RUSTSEC-2020-0081
Aug 25, 2021
mio invalidly assumes the memory layout of std::net::SocketAddr
5.5
/ 10
Medium
Local
Low
Low
None
Unchanged
None
None
High
The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens. Fixed in
0.7.6
References Updated Nov 08, 2023 · Source: OSV.dev | ||
0.7.0-alpha.1
unknown
yanked
|
0.7.0-alpha.1
unknown
yanked
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
0.6.21
unknown
|
0.6.21
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.6.20
unknown
|
0.6.20
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.6.19
unknown
|
0.6.19
unknown
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
0.6.18
unknown
|
0.6.18
unknown
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
0.6.17
unknown
|
0.6.17
unknown
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
0.6.16
unknown
|
0.6.16
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.6.15
unknown
|
0.6.15
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.6.14
unknown
|
0.6.14
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
0.6.13
unknown
|
0.6.13
unknown
Dependencies (14)
+ 6 more
Changelog
Compare changes
|