Skip to content
GitHub advisory IDGHSA-4q83-7cq4-p6wg

`tokio::io::ReadHalf<T>::unsplit` is Unsound

GHSA-4q83-7cq4-p6wg is a low-severity vulnerability in tokio (crates.io). Affected versions: >= 1.21.0, < 1.24.2; >= 1.19.0, < 1.20.4; >= 0.2.0, < 1.18.5. It is fixed in 1.24.2, 1.20.4 or 1.18.5, depending on the release line.

LowFix availableGitHub reviewed

Published 4 Feb 2023Updated 4 Feb 2023

No scoreNot yet rated
CVE ID
No CVE assigned
GHSA ID
GHSA-4q83-7cq4-p6wg
EPSS
Not scored
Weakness (CWE)
Not classified
KEV status
Not in KEV
Published
4 Feb 2023
Updated
4 Feb 2023
Ecosystem
  • crates.io (Rust)

Summary

Source: OSV (GitHub advisory)

tokio::io::ReadHalf<T>::unsplit can violate the Pin contract

The soundness issue is described in the tokio/issues#5372

Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code.

The tokio feature io-util is also required to be enabled to trigger this soundness issue.

Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e and carllerche appropriately responding and fixing the soundness bug.

Tokio before 0.2.0 used futures 0.1 that did not have Pin, so it is not affected by this issue.

Technical details

No CVSS vector has been published for this vulnerability yet.

Affected packages

Source: OSV (GitHub advisory)

  • tokio
    crates.io (Rust)
    pkg:cargo/tokio
    Affected versions
    >= 1.21.0, < 1.24.2
    >= 1.19.0, < 1.20.4
    >= 0.2.0, < 1.18.5
    Fixed in
    1.24.2
    1.20.4
    1.18.5

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 1.24.2, 1.20.4 or 1.18.5, depending on your release line.

Vulnerability intelligence

References

Questions about GHSA-4q83-7cq4-p6wg

Does GHSA-4q83-7cq4-p6wg have a CVE ID?
No CVE ID has been assigned to GHSA-4q83-7cq4-p6wg yet. It is tracked only as a GitHub advisory.
Which versions are affected by GHSA-4q83-7cq4-p6wg?
tokio (crates.io): >= 1.21.0, < 1.24.2; >= 1.19.0, < 1.20.4; >= 0.2.0, < 1.18.5.
How do I fix GHSA-4q83-7cq4-p6wg?
Upgrade to 1.24.2, 1.20.4 or 1.18.5, depending on the release line.
What is the Package URL (PURL) for GHSA-4q83-7cq4-p6wg?
The affected package's PURL is pkg:cargo/tokio.

Data sources

Upstream records

Fetched 5 days ago (8 Oct 2026, 19:50 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Weakness (CWE)
OSV (GitHub advisory)
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.