Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0221

`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`

Published Jul 13, 2026 · Updated Jul 31, 2026 · Assigned by RUSTSEC

Description

Affected versions of `event-listener` unconditionally implement `Send` and
`Sync` for `StackSlot<'_, T>`, the stack-allocated listener type created
by the `listener!` macro.

This allows a `!Send` tag type set via `Event::with_tag` to be moved to
another thread and accessed via `StackSlot::wait`, causing a data race in safe
code.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io event-listener >= 5.1.0, < 5.4.2 5.4.2 RUSTSEC-2026-0221

References