{"id":"RUSTSEC-2026-0221","summary":"`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`","details":"Affected versions of `event-listener` unconditionally implement `Send` and\n`Sync` for `StackSlot\u003c'_, T\u003e`, the stack-allocated listener type created\nby the `listener!` macro.\n\nThis allows a `!Send` tag type set via `Event::with_tag` to be moved to\nanother thread and accessed via `StackSlot::wait`, causing a data race in safe\ncode.","modified":"2026-07-31T12:15:04.629484145Z","published":"2026-07-13T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/event-listener"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0221.html"},{"type":"WEB","url":"https://github.com/smol-rs/event-listener/pull/163"}],"affected":[{"package":{"name":"event-listener","ecosystem":"crates.io","purl":"pkg:cargo/event-listener"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.4.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"os":[],"functions":[]}},"database_specific":{"cvss":null,"informational":"unsound","categories":["memory-corruption","thread-safety"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0221.json"}}],"schema_version":"1.7.5"}