Rust-lang vulnerabilities

Products

• Rust 24
• Cargo 8
• Async-h1 2
• Futures-task 2
• Future-utils 2

Newest

• rust project cargo Crates in third party registries can override the cached source of other crates CVE-2026-5223 Fix available 6.5 MediumMay 25, 2026
• rust cargo Cargo can be coerced to share credentials between registries CVE-2026-5222 Fix available 2.3 LowMay 25, 2026
• rust-lang rust Rust OS Command Injection/Argument Injection vulnerability CVE-2024-43402 8.2 HighSeptember 4, 2024
• go programming language golang, haskell process library, haskell programming language haskel +6 more +8 more Command injection vulnerability in programing languages on Microsoft Windows operating system. CVE-2024-3566 Fix available 9.8 CriticalApril 10, 2024
• rust-lang rust, fedoraproject fedora +1 more Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows CVE-2024-24576 Public exploitFix available EPSS 20.3% 10.0 CriticalApril 9, 2024
• rust-lang cargo, rust +1 more Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports CVE-2023-40030 Fix available 6.1 MediumAugust 24, 2023
• rust-lang cargo, fedoraproject fedora +1 more Cargo not respecting umask when extracting crate archives CVE-2023-38497 Public exploitFix available 7.8 HighAugust 3, 2023
• rust-lang cargo Cargo did not verify SSH host keys CVE-2022-46176 Fix available 5.3 MediumJanuary 10, 2023
• rust-lang cargo Extracting malicious crates can fill the file system CVE-2022-36114 Fix available 4.8 MediumSeptember 14, 2022
• rust-lang cargo Extracting malicious crates can corrupt arbitrary files CVE-2022-36113 Fix available 4.6 MediumSeptember 14, 2022
• rust-lang regex, debian linux, fedoraproject fedora +2 more Regular expression denial of service in Rust's regex crate CVE-2022-24713 Public exploitFix available EPSS 14.5% 7.5 HighMarch 8, 2022
• apple macos, rust-lang rust, apple ipados +4 more +6 more Race condition in std::fs::remove_dir_all in rustlang CVE-2022-21658 Public exploitFix available 7.3 HighJanuary 20, 2022
• rust-lang rust library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero... CVE-2021-29922 Fix available 9.1 CriticalAugust 7, 2021
• rust-lang rust In the standard library in Rust before 1.19.0, there is a synchronization problem in the... CVE-2017-20004 Fix available 5.9 MediumApril 14, 2021
• rust-lang rust, fedoraproject fedora +1 more In the standard library in Rust before 1.50.3, there is an optimization for joining strings that... CVE-2020-36323 Fix available 8.2 HighApril 14, 2021
• rust-lang rust In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut... CVE-2018-25008 Fix available 5.9 MediumApril 14, 2021
• rust-lang rust, fedoraproject fedora +1 more In the standard library in Rust before 1.53.0, a double free can occur in the Vec::from_iter... CVE-2021-31162 Fix available 9.8 CriticalApril 14, 2021
• rust-lang rust In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is... CVE-2015-20001 Fix available 7.5 HighApril 11, 2021
• rust-lang rust In the standard library in Rust before 1.49.0, String::retain() function has a panic safety... CVE-2020-36317 Fix available 7.5 HighApril 11, 2021
• rust-lang rust In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the... CVE-2020-36318 Fix available 9.8 CriticalApril 11, 2021
• rust-lang rust, fedoraproject fedora +1 more In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect... CVE-2021-28879 Fix available 9.8 CriticalApril 11, 2021
• rust-lang rust, fedoraproject fedora +1 more In the standard library in Rust before 1.52.0, the Zip implementation calls... CVE-2021-28878 Fix available 7.5 HighApril 11, 2021
• rust-lang rust In the standard library in Rust before 1.51.0, the Zip implementation calls... CVE-2021-28877 Fix available 7.5 HighApril 11, 2021
• rust-lang rust, fedoraproject fedora +1 more In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue.... CVE-2021-28876 Fix available 5.3 MediumApril 11, 2021
• rust-lang rust In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value... CVE-2021-28875 Fix available 7.5 HighApril 11, 2021
• rust-lang mdbook XSS in mdBook's search page CVE-2020-26297 Fix available 8.2 HighJanuary 4, 2021
• rust-lang async-h1 Async-h1 request smuggling possible with long unread bodies CVE-2020-36202 Fix available 6.1 MediumDecember 17, 2020
• http-rs async-h1 request smuggling in async-h1 CVE-2020-26281 Fix available 6.8 MediumDecember 17, 2020
• rust-lang socket2 socket2 invalidly assumes the memory layout of std::net::SocketAddr CVE-2020-35920 Fix available 5.5 MediumNovember 6, 2020
• rust-lang future-utils MutexGuard::map can cause a data race in safe code CVE-2020-35905 Fix available 4.7 MediumOctober 22, 2020
• rust-lang futures-task futures_task::waker may cause a use-after-free if used on a type that isn't 'static CVE-2020-35906 Fix available 7.8 HighSeptember 4, 2020
• rust-lang futures-task futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer CVE-2020-35907 Fix available 5.5 MediumMay 3, 2020
• rust-lang future-utils Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption CVE-2020-35908 Fix available 5.5 MediumJanuary 24, 2020
• rust cargo, rust-lang rust +1 more Cargo prior to Rust 1.26.0 may download the wrong dependency CVE-2019-16760 Fix available 4.6 MediumSeptember 30, 2019
• rust-lang rust, the rust programming language standard library +1 more The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200:... CVE-2019-1010299 Fix available 5.3 MediumJuly 15, 2019
• rust-lang rust, fedoraproject fedora, opensuse leap +2 more The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method... CVE-2019-12083 Fix available 8.1 HighMay 13, 2019
• rust-lang rust The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126... CVE-2018-1000810 Fix available 9.8 CriticalOctober 8, 2018
• rust-lang rust Rust Programming Language Rust standard library version Commit... CVE-2018-1000657 Fix available 7.8 HighAugust 20, 2018
• rust-lang rust The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427:... CVE-2018-1000622 Fix available 7.8 HighJuly 9, 2018