Rust-lang vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-43402 Rust is a programming language.High 8.1 · Sep 4, 2024
• CVE-2024-24576 Rust is a programming language.Critical 10 · Apr 9, 2024
• CVE-2023-38497 Cargo downloads the Rust project’s dependencies and compiles the project.High 7.9 · Aug 4, 2023
• CVE-2022-24713 regex is an implementation of regular expressions for the Rust language.High 7.5 · Mar 8, 2022
• CVE-2022-21658 Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency.High 7.3 · Jan 20, 2022
• CVE-2021-29922 library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in soCritical 9.1 · Aug 7, 2021
• CVE-2021-31162 In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.Critical 9.8 · Apr 14, 2021
• CVE-2020-36323 In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to High 8.2 · Apr 14, 2021
• CVE-2021-28879 In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow.Critical 9.8 · Apr 11, 2021
• CVE-2021-28878 In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditioHigh 7.5 · Apr 11, 2021
• CVE-2021-28877 In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested.High 7.5 · Apr 11, 2021
• CVE-2021-28875 In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context.High 7.5 · Apr 11, 2021
• CVE-2020-36318 In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition.Critical 9.8 · Apr 11, 2021
• CVE-2020-36317 In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem.High 7.5 · Apr 11, 2021
• CVE-2015-20001 In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe.High 7.5 · Apr 11, 2021
• CVE-2020-26297 mdBook is a utility to create modern online books from Markdown files and is written in Rust.High 8.2 · Jan 4, 2021
• CVE-2020-35906 An issue was discovered in the futures-task crate before 0.3.6 for Rust.High 7.8 · Dec 31, 2020
• CVE-2019-12083 The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and High 8.1 · May 13, 2019
• CVE-2018-1000810 The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to BufferCritical 9.8 · Oct 8, 2018
• CVE-2018-1000657 Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a BufHigh 7.8 · Aug 20, 2018
• CVE-2018-1000622 The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that High 7.8 · Jul 9, 2018