GHSA-w443-5h3j-jqcp: Duplicate Advisory: crossbeam-channel Vulnerable to Double Free on Drop

May 14, 2025 (updated May 15, 2025)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pg9f-39pc-qf8g. This link is maintained to preserve external references.

Original Description

In crossbeam-channel rust crate, the internal Channel type’s Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

References

access.redhat.com/security/cve/CVE-2025-4574
bugzilla.redhat.com/show_bug.cgi?id=2358890
github.com/advisories/GHSA-w443-5h3j-jqcp
github.com/crossbeam-rs/crossbeam/pull/1187
nvd.nist.gov/vuln/detail/CVE-2025-4574

Code Behaviors & Features

Detect and mitigate GHSA-w443-5h3j-jqcp with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →