Tagged “rust”
CVEs tagged rust, newest first.
666 CVEsRSS
RUSTSEC-2026-0363Medium· 6.2Component-model handle tables are capped only per instance and charged to no limit
Component-model handle tables are capped only per instance and charged to no limit
RUSTSEC-2026-0362NoneWasmtime may not properly enforce async-entrypoint requirement
Wasmtime may not properly enforce async-entrypoint requirement
RUSTSEC-2026-0361NonePanic when pending calls are run after a trap
Panic when pending calls are run after a trap
RUSTSEC-2026-0360NoneOverlapping string transcode in a fused adapter can panic
Overlapping string transcode in a fused adapter can panic
RUSTSEC-2026-0359Medium· 5.3Stack overflow dropping a long chain of recursive types
Stack overflow dropping a long chain of recursive types
RUSTSEC-2026-0358NoneYielding in a component start function can lead to a host panic
Yielding in a component start function can lead to a host panic
RUSTSEC-2026-0357NoneOut-of-bounds zero-length stream writes can panic
Out-of-bounds zero-length stream writes can panic
RUSTSEC-2026-0356Medium· 5.3Panic on erroneous call-to-host from guest realloc call
Panic on erroneous call-to-host from guest realloc call
RUSTSEC-2026-0355NonePanic viewing component model stream or future as the wrong type
Panic viewing component model stream or future as the wrong type
RUSTSEC-2026-0354NoneHost panic when component `call_async` is cancelled under some conditions
Host panic when component `call_async` is cancelled under some conditions
RUSTSEC-2026-0353NonePanic when invoking an async-lifted function via `call`
Panic when invoking an async-lifted function via `call`
RUSTSEC-2026-0352NoneFilesystem sandbox escape when renaming symlinks with trailing slashes
Filesystem sandbox escape when renaming symlinks with trailing slashes
RUSTSEC-2026-0351Medium· 5.3`wasi-http`: Request with long url before query parameter crashes host
`wasi-http`: Request with long url before query parameter crashes host
RUSTSEC-2026-0350NoneGuests can send absolute-form HTTP requests to different hosts
Guests can send absolute-form HTTP requests to different hosts
RUSTSEC-2026-0349Low· 3.7Unauthenticated ServerHello can downgrade later connections to classical key exchange
Unauthenticated ServerHello can downgrade later connections to classical key exchange
RUSTSEC-2026-0348Low· 3.7Brotli certificate decompression can allocate up to 1 GiB before authentication
Brotli certificate decompression can allocate up to 1 GiB before authentication
RUSTSEC-2026-0347Low· 2.3Buffered application data sent to outer server after ECH rejection
Buffered application data sent to outer server after ECH rejection
RUSTSEC-2026-0346Medium· 4.0`Debug` impls for client session values expose TLS secrets
`Debug` impls for client session values expose TLS secrets
CVE-2026-103929High· 7.8PoCmise manages dev tools like node, python, cmake, and terraform
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings remove…
RUSTSEC-2026-0386None`AsyncFd::new` and related constructors violate I/O safety
`AsyncFd::new` and related constructors violate I/O safety
CVE-2026-102342Medium· 5.4ammonia is a Rust library for repairing and securing untrusted HTML
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses …
RUSTSEC-2026-0344High· 7.5Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
RUSTSEC-2026-0369Critical· 9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
RUSTSEC-2026-0368Nonezip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
RUSTSEC-2026-0367High· 7.3Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
RUSTSEC-2026-0337High· 7.5Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
RUSTSEC-2026-0336High· 7.5MIKEY message MAC is never verified on receive, so forged messages are accepted
MIKEY message MAC is never verified on receive, so forged messages are accepted
RUSTSEC-2026-0335Critical· 9.1Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
MAL-2026-17713Critical⚠ ExploitedMalicious code in sharpnes (crates.io)
Malicious code in sharpnes (crates.io)
RUSTSEC-2026-0333NoneResource budgets not enforced on the typed deserialization path
Resource budgets not enforced on the typed deserialization path