Vendor
Rust
69 known vulnerabilities in products by Rust, 0 of them actively exploited (CISA KEV).
Key figures
69
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-115889 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | 9.9 | |
| Critical | CVE-2026-115893 | Bytecode Alliance wasmtime: Insufficient Control Flow Management | 9.9 | |
| Critical | CVE-2026-115905 | Zip-rs Zip2: Improper Input Validation | — | |
| High | CVE-2026-96889 | Librsvg: use-after-free when xml includes have duplicated entities | 7.8 | |
| Medium | CVE-2026-63430 | ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip | — | |
| Medium | CVE-2026-115892 | Bytecode Alliance wasmtime: Uncaught Exception | — | |
| Medium | CVE-2026-113799 | Slack Morphism verifier errors disclose valid HMACs in the logs | 5.3 | |
| Medium | CVE-2026-5222 | Cargo can be coerced to share credentials between registries | 6.5 | |
| High | CVE-2019-16760 | Cargo prior to Rust 1.26.0 may download the wrong dependency | 4.6 | |
| Medium | CVE-2026-102820 | Eugeny Russh: Memory Allocation with Excessive Size Value | 6.2 | |
| Medium | CVE-2026-115567 | Tokio: Race condition in `tokio::time::Interval` | — | |
| Medium | CVE-2026-111061 | russh agent server converts constraint records into unbounded never-rolled-back tasks | 4.3 | |
| Low | CVE-2026-115569 | Fallow: Path Traversal | 3.3 | |
| Low | — | rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert | — | |
| Low | — | rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share | — | |
| Medium | — | Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs | — | |
| Low | — | Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. | — | |
| Low | — | Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root | — | |
| High | — | gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options() | — | |
| Not rated | CVE-2026-111062 | Russh: Improper Verification of Cryptographic Signature | — | |
| High | — | lopdf has a stack overflow via deeply nested PDF objects | — | |
| Medium | — | Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | — | |
| Medium | — | hickory-resolver follows irrelevant CNAME records | — | |
| High | — | hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS) | — | |
| High | — | hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures | — |
Products
| Surrealdb | 26 | 0 |
| Rustls | 5 | 0 |
| Hickory-resolver | 3 | 0 |
| Wasmtime | 3 | 0 |