GHSA-rr8g-9fpq-6wmg
MediumAdvisory
Published 7 Apr 2025In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 4
- of 17,781 indexed, latest versions
- Container images
- 4
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
Carried by container images the latest versions of 4 of 17,781 indexed charts deploy, on 4 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| tokiocargo | 1.40.0, 1.43.0, 1.44.1 | 1.38.2, 1.43.1, 1.44.2 | 4 |
- OSV records
- GHSA-rr8g-9fpq-6wmgRUSTSEC-2025-0023
Charts affected
4 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| karakeepself-hosters-by-nightVerified publisher | 2.5.1 | 1 of 1See more | 5,213 |
| nostr-rs-relayk8s-chartsVerified publisher | 1.0.1 | 1 of 1See more | 3,354 |
| matrix-stackrock8sVerified publisher | 0.8.1 | 1 of 7See more | 9,256 |
| karakeeprtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 3See more | 5,338 |
Container images carrying it
4 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| scsibug/ | 03f54bfbffff | tokio tokio | 1.43.1 1.38.2 | 1 |
| ghcr.io/ | 834ea54370f0 | tokio tokio | 1.43.1 1.38.2 | 1 |
| ghcr.io/ | abd7d6b11b1b | tokio tokio | 1.44.2 1.38.2 | 1 |
| ghcr.io/ | f575a34ed3f8 | tokio tokio | 1.44.2 1.38.2 | 1 |