{"action":"Upgrade tokio to 1.38.2 or later.","affected":[{"fixed":"1.38.2","introduced":"0.2.5"},{"fixed":"1.42.1","introduced":"1.39.0"},{"fixed":"1.43.1","introduced":"1.43.0"},{"fixed":"1.44.2","introduced":"1.44.0"}],"component":"tokio","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["1.38.2","1.42.1","1.43.1","1.44.2"],"ghsa_id":"GHSA-rr8g-9fpq-6wmg","id":"tcs_01M5KF9VTV1TSFXD6JDPCNE2H8","modified_at":"2025-10-28T06:29:26.130595Z","published_at":"2025-04-07T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2025-0023","https://crates.io/crates/tokio","https://rustsec.org/advisories/RUSTSEC-2025-0023.html","https://github.com/tokio-rs/tokio/pull/7232"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2025-0023","url":"https://osv.dev/vulnerability/RUSTSEC-2025-0023"}],"summary":"Broadcast channel calls clone in parallel, but does not require `Sync`"}