CVE-2021-45710: Race Condition in tokio

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-27 · updated 2026-06-17
Weakness: CWE-362

Description

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.

Affected products

tokio-rs tokio: from 0.1.14 before 1.8.4; from 1.9.0 before 1.13.1 — fixed in 1.13.1, 1.8.4
Crates.Io Tokio: from 0.1.14 before 1.8.4; from 1.9.0 before 1.13.1 — fixed in 1.8.4, 1.13.1

How to fix

Upgrade to a fixed version: tokio-rs tokio 1.13.1, 1.8.4; Crates.Io Tokio 1.8.4, 1.13.1. Check the vendor advisory for mitigations.

References

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0124.md
https://rustsec.org/advisories/RUSTSEC-2021-0124.html
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0124.md
https://rustsec.org/advisories/RUSTSEC-2021-0124.html

Get alerted when CVE-2021-45710 or the next vulnerability affects your stack