CVE-2026-46690: Unbounded-spsc Race Condition Vulnerability

CVE-2026-46690 Overview

CVE-2026-46690 affects unbounded_spsc, a Rust crate that extends bounded_spsc_queue to provide an unbounded single-producer single-consumer (SPSC) channel. Versions 0.2.0 and prior contain a memory safety defect in the sender::send function. The implementation performs a pointer-as-value transmute that triggers an out-of-bounds read and drops a fake Arc when the transmit (TX) and receive (RX) sides race. No patches are publicly available at the time of publication.

Critical Impact
A local attacker who can influence concurrent TX/RX timing can trigger out-of-bounds memory reads and unsound Arc drops, leading to potential information disclosure and process crashes [CWE-125].

Affected Products

spearman/unbounded-spsc versions 0.2.0 and prior
Rust applications depending on the unbounded_spsc crate
Concurrent workloads using the affected SPSC channel for inter-thread messaging

Discovery Timeline

2026-06-12 - CVE-2026-46690 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46690

Vulnerability Analysis

The vulnerability resides in the sender::send code path of unbounded_spsc. The implementation uses an unsafe transmute that treats a raw pointer as a value type. When the producer and consumer threads race, the transmuted value is read past its valid memory region, producing an out-of-bounds read [CWE-125].

The same flaw causes the runtime to construct and drop a synthetic Arc that was never legitimately allocated. Dropping this fake Arc decrements a reference count on memory the channel does not own. The result is undefined behavior in Rust's ownership model, with consequences ranging from data corruption to process termination.

The vulnerability is locally exploitable. Attack complexity is high because it requires precise timing between concurrent TX and RX operations on the shared channel.

Root Cause

The root cause is unsound use of std::mem::transmute to reinterpret a pointer as a different value type inside sender::send. The transmute bypasses Rust's type system and removes the memory-safety guarantees the language normally provides. Combined with a missing synchronization barrier between the producer and consumer, the unsound transmute is reachable under concurrent access.

Attack Vector

An attacker requires local code execution within the same process that uses the vulnerable crate. The adversary must drive workloads that exercise the SPSC channel concurrently and shape thread scheduling to trigger the TX/RX race. Successful exploitation reads memory outside the intended object and drops a forged Arc, which can leak adjacent heap contents or crash the process.

No public proof-of-concept exploit is currently available. See the GitHub Security Advisory GHSA-6m57-8r3p-pqx6 for additional technical context.

Detection Methods for CVE-2026-46690

Indicators of Compromise

Unexpected process aborts or SIGSEGV crashes in Rust binaries that link unbounded_spsc0.2.0 or earlier
AddressSanitizer or Miri reports flagging out-of-bounds reads inside sender::send
Heap corruption diagnostics referencing Arc drop paths with no matching allocation

Detection Strategies

Audit Cargo.lock and dependency manifests across build pipelines for any reference to unbounded-spsc at version 0.2.0 or below
Run the codebase under cargo miri test to surface the unsound transmute and race condition during continuous integration
Enable ThreadSanitizer in test builds to identify the TX/RX data race that triggers the unsafe code path

Monitoring Recommendations

Forward application crash telemetry and core dumps to centralized logging to flag repeated faults in producer-consumer workers
Track dependency inventory through Software Bill of Materials (SBOM) tooling to alert on vulnerable crate versions entering production
Monitor host-level signals for unexpected child process terminations correlated with workloads exercising the SPSC channel

How to Mitigate CVE-2026-46690

Immediate Actions Required

Inventory all Rust projects that depend on unbounded-spsc and isolate services running version 0.2.0 or earlier
Replace the vulnerable channel with a maintained alternative such as crossbeam-channel or flume for concurrent SPSC messaging
Restrict local access to systems running affected workloads to reduce the attacker pool able to influence thread timing

Patch Information

No patched version of unbounded-spsc is publicly available at the time of publication. Monitor the GitHub Security Advisory GHSA-6m57-8r3p-pqx6 for updates from the maintainer.

Workarounds

Migrate to an actively maintained SPSC or MPMC channel crate that does not rely on pointer-as-value transmutes
Wrap calls to sender::send with external synchronization primitives to serialize producer and consumer access where migration is not yet possible
Disable code paths that exercise the unbounded channel in production until a fixed release is available

bash

# Audit Rust projects for the vulnerable crate version
cargo tree -i unbounded-spsc
cargo audit

# Remove the dependency and replace with a maintained alternative
cargo remove unbounded-spsc
cargo add crossbeam-channel