CVE-2020-35898: Use after free in actix-utils

August 25, 2021 (updated May 23, 2025)

An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.

References

github.com/actix/actix-net
github.com/actix/actix-net/commit/0dca1a705ad1ff4885b3491ecb809a808e1de66c
github.com/actix/actix-net/issues/160
github.com/advisories/GHSA-hhw2-pqhf-vmx2
nvd.nist.gov/vuln/detail/CVE-2020-35898
rustsec.org/advisories/RUSTSEC-2020-0045.html

Code Behaviors & Features

Detect and mitigate CVE-2020-35898 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →