Tagged “rust”
CVEs tagged rust, newest first.
709 CVEsRSS
CVE-2026-63127High· 8.2PoCRMCP is an official Rust SDK for the Model Context Protocol
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oau…
CVE-2026-61544High· 8.2PoClibp2p-rust is the official Rust language implementation of the libp2p networking stack
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate an…
RUSTSEC-2026-0343High· 7.5Outgoing datagram buffer accounting can panic the sender in quinn-proto
Outgoing datagram buffer accounting can panic the sender in quinn-proto
RUSTSEC-2026-0340High· 7.5Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
RUSTSEC-2026-0338NoneRemote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
RUSTSEC-2026-0285Medium· 5.3TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
CVE-2025-24890Medium· 6.8PoCgitoxide is an implementation of git written in Rust
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered e…
CVE-2026-54541Low· 3.7Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two Trie…
CVE-2026-54542Low· 3.7Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a Tr…
CVE-2026-55832Medium· 6.1PoCTract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tens…
CVE-2026-55093Medium· 6.1PoCTract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor di…
RUSTSEC-2026-0283Noneclear_on_drop is unmaintained
clear_on_drop is unmaintained
RUSTSEC-2026-0298NoneUse-after-free when a future's `Drop` panics while the container is dropped
Use-after-free when a future's `Drop` panics while the container is dropped
MAL-2026-16164Critical⚠ ExploitedMalicious code in logs_update (crates.io)
Malicious code in logs_update (crates.io)
CVE-2026-45057Medium· 4.9matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk
matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself i…
CVE-2026-45056Medium· 6.9⚖ disputedmatrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients
matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the…
GHSA-wfgq-w7cq-qj7jHigh· 7.2mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
GHSA-m3wp-48jr-vr4gHigh· 7.5mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
RUSTSEC-2026-0297None`unzip`: archive extraction is vulnerable to path traversal (zip-slip)
`unzip`: archive extraction is vulnerable to path traversal (zip-slip)
RUSTSEC-2026-0291NoneDouble free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics
Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics
RUSTSEC-2026-0282NoneDouble free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics
Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics
CVE-2026-53956Medium· 5.4Rattler vulnerable to package cache path traversal via conda package build string
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cache path traversal when handling packag…
RUSTSEC-2026-0332None`WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`
`WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`
RUSTSEC-2026-0281None`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
RUSTSEC-2026-0280None`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code
`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code
RUSTSEC-2026-0292NoneDouble free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
CVE-2026-63733Medium· 4.3SurrealDB: Writes in a PERMISSIONS clause bypass table permissions
SurrealDB: Writes in a PERMISSIONS clause bypass table permissions
CVE-2026-63735High· 8.1SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
RUSTSEC-2026-0300NoneUse-after-free in `clear` and `retain` when an element's `Drop` panics
Use-after-free in `clear` and `retain` when an element's `Drop` panics
CVE-2026-53600Mediumasync-tar is a tar archive reading/writing library for async Rust
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) …