CVE Program partner

rust

The Rust Project

API
CVEs, 365 days23 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationThe Rust Project
RoleCNA
TypeVendor, Open Source
Reports toredhat → mitre
ScopeRepositories, packages, and websites maintained by the Rust Project. More details: <a href='https://www.rust-lang.org/policies/security#scope' target='_blank'>https://www.rust-lang.org/policies/security#scope</a>.
Advisorieshttps://groups.google.com/g/rustlang-security-announcements

Latest CVEs · RSS

  • CVE-2026-5223 2026-05-25 · CVSS 6.5
    Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of an
  • CVE-2026-5222 2026-05-25 · CVSS 2.3
    Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple re
  • CVE-2025-11233 2025-10-01 · CVSS 6.3
    Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard li

All CVE Program partners