CVE-2022-23639

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.

• CWE-362

• https://github.com/crossbeam-rs/crossbeam/pull/781Issue Tracking, Patch, Third Party Advisory
• https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7Patch, Third Party Advisory
• https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926Exploit, Third Party Advisory
• https://github.com/crossbeam-rs/crossbeam/pull/781Issue Tracking, Patch, Third Party Advisory
• https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7Patch, Third Party Advisory
• https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926Exploit, Third Party Advisory

Published

Feb 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23633Action Pack is a framework for handling and responding to we…5.9
• CVE-2022-23634Puma is a Ruby/Rack web server built for parallelism. Prior …5.9
• CVE-2022-23635Istio is an open platform to connect, manage, and secure mic…7.5
• CVE-2022-23636Wasmtime is an open source runtime for WebAssembly & WASI. P…8.1
• CVE-2022-23637K-Box is a web-based application to manage documents, images…5.4
• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1
• CVE-2022-2364A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8
• CVE-2022-23641Discourse is an open source discussion platform. In versions…6.5
• CVE-2022-23642Sourcegraph is a code search and navigation engine. Sourcegr…8.8
• CVE-2022-23643Sourcegraph is a code search and navigation engine. Sourcegr…6.5
• CVE-2022-23644BookWyrm is a decentralized social network for tracking read…8.8