Rust-lang - vulnerabilities (CVEs)

39 CVEs in 8 products, 0 in the last 30 days, newest from 2026-05-25.

Products

Rust - 24 CVEs
Cargo - 6 CVEs
Async-h1 - 2 CVEs
Future-utils - 2 CVEs
Futures-task - 2 CVEs
Mdbook - 1 CVEs
Regex - 1 CVEs
Socket2 - 1 CVEs

Newest CVEs of Rust-lang

CVE-2026-5223 - CVSS 6.5 (medium), 2026-05-25: Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of…
CVE-2026-5222 - CVSS 6.5 (medium), 2026-05-25: Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple…
CVE-2024-43402 - CVSS 8.8 (high), 2024-09-04: Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows,…
CVE-2024-3566 - CVSS 9.8 (critical), 2024-04-10: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function…
CVE-2024-24576 - CVSS 10 (critical), 2024-04-09: Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape…
CVE-2023-40030 - CVSS 6.1 (medium), 2023-08-24: Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names…
CVE-2023-38497 - CVSS 7.9 (high), 2023-08-04: Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not…
CVE-2022-46176 - CVSS 5.9 (medium), 2023-01-11: Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and…
CVE-2022-36113 - CVSS 8.1 (high), 2022-09-14: Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk,…
CVE-2022-36114 - CVSS 6.5 (medium), 2022-09-14: Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed…
CVE-2022-24713 - CVSS 7.5 (high), 2022-03-08: regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks…
CVE-2022-21658 - CVSS 7.3 (high), 2022-01-20: Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG…
CVE-2021-29922 - CVSS 9.1 (critical), 2021-08-07: library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in…
CVE-2020-36323 - CVSS 8.2 (high), 2021-04-14: In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program…
CVE-2021-31162 - CVSS 9.8 (critical), 2021-04-14: In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.
CVE-2018-25008 - CVSS 5.9 (medium), 2021-04-14: In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory…
CVE-2017-20004 - CVSS 5.9 (medium), 2021-04-14: In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any…
CVE-2021-28876 - CVSS 5.3 (medium), 2021-04-11: In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the…
CVE-2021-28879 - CVSS 9.8 (critical), 2021-04-11: In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer…
CVE-2015-20001 - CVSS 7.5 (high), 2021-04-11: In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic…
CVE-2021-28875 - CVSS 7.5 (high), 2021-04-11: In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a…
CVE-2021-28878 - CVSS 7.5 (high), 2021-04-11: In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain…
CVE-2020-36318 - CVSS 9.8 (critical), 2021-04-11: In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug…
CVE-2021-28877 - CVSS 7.5 (high), 2021-04-11: In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug…
CVE-2020-36317 - CVSS 7.5 (high), 2021-04-11: In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the…
CVE-2020-36202 - CVSS 6.1 (medium), 2021-01-26: An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.
CVE-2020-26297 - CVSS 8.2 (high), 2021-01-04: mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability…
CVE-2020-35920 - CVSS 5.5 (medium), 2020-12-31: An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
CVE-2020-35907 - CVSS 5.5 (medium), 2020-12-31: An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.
CVE-2020-35906 - CVSS 7.8 (high), 2020-12-31: An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.