LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36459: An issue was discovered in the dces crate through 2020-12-09 for Rust.

An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-36459 is a Rust dependency issue in the dces crate. The crate marks its World type as safe to send between threads, but the underlying stores may not meet that requirement. This can undermine Rust’s normal thread-safety guarantees in applications using affected dces versions.

Executive priority

Medium operational priority if dces is present in production software; otherwise low. The business urgency depends on dependency presence and threaded usage. No active exploitation evidence is provided, but Rust memory-safety issues can affect reliability and trust in affected services.

Technical view

The issue is an unsafe Send implementation or declaration: World is marked Send without bounds on EntityStore and ComponentStore. If non-Send stores are used, moving World across threads may create unsound behavior. The source bundle does not provide CVSS, CWE, exploitability, or fixed-version details.

Likely exposure

Exposure is likely limited to Rust applications that depend on the dces crate through 2020-12-09, especially where World instances may cross thread boundaries. The CVE record does not name downstream products or package versions beyond that date-based statement.

Exploitation context

The source bundle does not show active exploitation, public exploit activity, or CISA KEV listing. Treat this as a dependency-level memory-safety concern requiring inventory and vendor-advisory review, not as confirmed in-the-wild exploitation.

Researcher notes

Key evidence is narrow: dces World is Send without appropriate store bounds. There is no CVSS, CWE, fixed release, or exploit detail in the supplied bundle. Research should focus on dependency reachability and whether application code can move unsafe World instances between threads.

Mitigation direction

  • Identify applications using the dces Rust crate.
  • Check RustSec and upstream guidance for fixed or recommended versions.
  • Update, replace, or remove affected dces usage where guidance supports it.
  • Limit cross-thread sharing of World until remediation is confirmed.
  • Prioritize systems where dces is used in concurrent execution paths.

Validation and detection

  • Review dependency manifests and lockfiles for dces usage.
  • Confirm whether the version predates or includes 2020-12-09 exposure.
  • Review code paths that move World across threads.
  • Check whether EntityStore or ComponentStore types satisfy thread-safety requirements.
  • Document any compensating constraints or confirmed non-exposure.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-36459 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.