Rust security · 1,308 RustSec advisories · data from Oct 24, 2026
Rust security advisories: every RUSTSEC, explained with the fix
Got a RUSTSEC ID from cargo-audit, cargo-deny or Dependabot? Search it here for what it means, whether your version is affected, and the exact command to fix it. Or look up a crate before you depend on it.
1,308RustSec advisories
827vulnerabilities
261unmaintained crates
214unsound APIs
1,635crates with a record
Check a whole project at once
Paste your Cargo.lock into the Cargo.toml checker: it matches every advisory against the exact versions you build, in your browser.
Newest advisories
- VulnerabilityRUSTSEC-2026-0385 · 2026-10-23 · ctutilsNon-constant-time mask generation and `u128` comparisons
- VulnerabilityRUSTSEC-2026-0387 · 2026-10-23 · crypto-bigintMultiple timing variability issues in operations intended to be constant-time
- VulnerabilityRUSTSEC-2026-0384 · 2026-10-21 · tokioRace condition in `tokio::time::Interval` on Tokio v1.54.0
- VulnerabilityRUSTSEC-2026-0382 · 2026-10-20 · rustls-webpkiCertificate verification may accept distrusted intermediates
- Vulnerability MediumRUSTSEC-2026-0375 · 2026-10-19 · wasmtime-wasi-http`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
- Vulnerability LowRUSTSEC-2026-0376 · 2026-10-19 · wasmtime-wasi-http`wasi-http`: Guests can add conflicting content lengths to messages
- Vulnerability LowRUSTSEC-2026-0377 · 2026-10-19 · wasmtime-wasi-http`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
- VulnerabilityRUSTSEC-2026-0378 · 2026-10-19 · wasmtimePanic lowering a host-created component model stream into a guest that expects a different payload type
- Vulnerability CriticalRUSTSEC-2026-0379 · 2026-10-19 · wasmtimeCranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- Vulnerability CriticalRUSTSEC-2026-0380 · 2026-10-19 · wasmtimeBit-packing in Cranelift compiler causes silent overflow and miscompilation
- VulnerabilityRUSTSEC-2026-0381 · 2026-10-19 · webpki-rootsBundled root certificates allow trust in distrusted emSign intermediates
- VulnerabilityRUSTSEC-2026-0383 · 2026-10-19 · webpki-root-certsBundled root certificates allow trust in distrusted emSign intermediates
- Vulnerability LowRUSTSEC-2026-0366 · 2026-10-16 · pest_grammarsStack overflow when parsing deeply nested input in pest_grammars
- UnmaintainedRUSTSEC-2026-0370 · 2026-10-16 · zvariant`zvariant` is unmaintained
- UnmaintainedRUSTSEC-2026-0371 · 2026-10-16 · zbus_names`zbus_names` is unmaintained
- UnmaintainedRUSTSEC-2026-0372 · 2026-10-16 · zvariant_derive`zvariant_derive` is unmaintained
- VulnerabilityRUSTSEC-2026-0373 · 2026-10-16 · ammoniaMissing case-insensitive matching for CSS url function
- Vulnerability MediumRUSTSEC-2026-0346 · 2026-10-14 · rustls`Debug` impls for client session values expose TLS secrets
- Vulnerability LowRUSTSEC-2026-0347 · 2026-10-14 · rustlsBuffered application data sent to outer server after ECH rejection
- Vulnerability LowRUSTSEC-2026-0348 · 2026-10-14 · rustlsBrotli certificate decompression can allocate up to 1 GiB before authentication
- Vulnerability LowRUSTSEC-2026-0349 · 2026-10-14 · rustlsUnauthenticated ServerHello can downgrade later connections to classical key exchange
- VulnerabilityRUSTSEC-2026-0350 · 2026-10-14 · wasmtime-wasi-httpGuests can send absolute-form HTTP requests to different hosts
- Vulnerability MediumRUSTSEC-2026-0351 · 2026-10-14 · wasmtime-wasi-http`wasi-http`: Request with long url before query parameter crashes host
- VulnerabilityRUSTSEC-2026-0352 · 2026-10-14 · wasmtime-wasiFilesystem sandbox escape when renaming symlinks with trailing slashes
- VulnerabilityRUSTSEC-2026-0353 · 2026-10-14 · wasmtimePanic when invoking an async-lifted function via `call`
Most common kinds of bug
| Category | Advisories |
|---|---|
| memory-corruption | 285 |
| denial-of-service | 142 |
| crypto-failure | 96 |
| memory-exposure | 91 |
| malicious | 75 |
| thread-safety | 65 |
| code-execution | 41 |
| format-injection | 25 |
| privilege-escalation | 22 |
| file-disclosure | 18 |
Unmaintained crates and what to use instead
261 crates RustSec has marked unmaintained. Where the advisory names a successor, it is listed.
How we built this
We load OSV's full crates.io export (2,969 records: RustSec, GitHub-reviewed and malicious-package advisories), compute CVSS 3.x base scores from the published vectors, and turn each version range into plain words. Withdrawn advisories are left out. RustSec data is CC0-1.0.
Up next
Are you affected?Check your dependency treePaste Cargo.lock for an instant audit.Read it next →Did this answer your question?