tokio has 4 CVEs on record between 2023 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.8 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.8
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Weakness classes
Products
- tokio 4
4
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-115567Medium· 5.8Race condition in `tokio::time::Interval` on Tokio v1.54.032RUSTSEC-2026-0384NoneRace condition in `tokio::time::Interval` on Tokio v1.54.03RUSTSEC-2026-0386None`AsyncFd::new` and related constructors violate I/O safety3CVE-2023-22466Nonereject_remote_clients Configuration corruption3
tokio vulnerabilities
CVEs affecting tokio, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-115567Medium· 5.8Race condition in `tokio::time::Interval` on Tokio v1.54.0
Race condition in `tokio::time::Interval` on Tokio v1.54.0
▾ Sunlittokio · tokioEPSS 0.11%via OSV
RUSTSEC-2026-0384NoneRace condition in `tokio::time::Interval` on Tokio v1.54.0
Race condition in `tokio::time::Interval` on Tokio v1.54.0
▾ Sunlittokio · tokiovia OSV
RUSTSEC-2026-0386None`AsyncFd::new` and related constructors violate I/O safety
`AsyncFd::new` and related constructors violate I/O safety
▾ Sunlittokio · tokiovia OSV
CVE-2023-22466Nonereject_remote_clients Configuration corruption
reject_remote_clients Configuration corruption
▾ Sunlittokio · tokioEPSS 0.59%via OSV