Browse CVEs

MEDIUM 6.5 CVE-2026-5222 Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed … Cargo 1.96.0+ Fix from $1,6002026-05-25 MEDIUM 5.3 CVE-2026-5223 Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source… Cargo 1.96.0+ Fix from $1,6002026-05-25 HIGH 8.8 CVE-2024-43402 Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on … Rust 1.81.0+ Fix from $1,9502024-09-04 MEDIUM 6.1 CVE-2023-40030 Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature… Rust 1.72.0+ Fix from $1,6002023-08-24 HIGH 7.3 CVE-2023-38497 Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, d… Cargo 0.72.2+ Fix from $1,9502023-08-04 MEDIUM 5.9 CVE-2022-46176 Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes… Cargo after 0.67.0 Fix from $1,6002023-01-11 HIGH 8.1 CVE-2022-36113 Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on… Cargo 0.65.0+ Fix from $1,9502022-09-14 MEDIUM 6.5 CVE-2022-36114 Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed… Cargo 0.65.0+ Fix from $1,6002022-09-14 HIGH 7.5 CVE-2022-24713EPSS 14% regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service a… Regex 1.5.5+ Fix from $1,9502022-03-08 MEDIUM 6.3 CVE-2022-21658 Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Re… Rust 8.5 / 12.3+ Fix from $1,6002022-01-20 CRITICAL 9.1 CVE-2021-29922 library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, w… Rust 1.53.0+ Fix from $2,3002021-08-07 CRITICAL 9.8 CVE-2021-31162 In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. Rust 1.52.0+ Fix from $2,3002021-04-14 HIGH 8.2 CVE-2020-36323 In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the … Rust 1.52.0+ Fix from $1,9502021-04-14 MEDIUM 5.9 CVE-2017-20004 In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads wi… Rust 1.19.0+ Fix from $1,6002021-04-14 MEDIUM 5.9 CVE-2018-25008 In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to me… Rust 1.29.0+ Fix from $1,6002021-04-14 CRITICAL 9.8 CVE-2020-36318 In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition.… Rust 1.49.0+ Fix from $2,3002021-04-11 CRITICAL 9.8 CVE-2021-28879 In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a… Rust 1.52.0+ Fix from $2,3002021-04-11 HIGH 7.5 CVE-2015-20001 In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of g… Rust 1.2.0+ Fix from $1,9502021-04-11 HIGH 7.5 CVE-2020-36317 In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string wh… Rust 1.49.0+ Fix from $1,9502021-04-11 HIGH 7.5 CVE-2021-28875 In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead t… Rust 1.50.0+ Fix from $1,9502021-04-11 HIGH 7.5 CVE-2021-28877 In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested.… Rust 1.51.0+ Fix from $1,9502021-04-11 HIGH 7.5 CVE-2021-28878 In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certa… Rust 1.52.0+ Fix from $1,9502021-04-11 MEDIUM 5.3 CVE-2021-28876 In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once fo… Rust 1.52.0+ Fix from $1,6002021-04-11 MEDIUM 6.1 CVE-2020-36202 An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy. Async H1 2.3.0+ Fix from $1,6002021-01-26 MEDIUM 6.1 CVE-2020-26297 mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerabilit… Mdbook 0.4.5+ Fix from $1,6002021-01-04 MEDIUM 5.5 CVE-2020-35920 An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation. Socket2 0.3.16+ Fix from $1,6002020-12-31 HIGH 7.8 CVE-2020-35906 An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situatio… Futures Task 0.3.6+ Fix from $1,9502020-12-31 MEDIUM 5.5 CVE-2020-35907 An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference. Futures Task 0.3.5+ Fix from $1,6002020-12-31 MEDIUM 5.5 CVE-2020-35908 An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled. Future Utils 0.3.2+ Fix from $1,6002020-12-31 HIGH 7.5 CVE-2020-26281 async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This v… Async H1 2.3.0+ Fix from $1,9502020-12-21