Rust advisories / crate
Security history · tough · data from Oct 24, 2026
Is tough safe to use? Its security history
VerdictNo open advisories. 10 past vulnerabilities were fixed; use 0.7.1 or newer to be clear of all of them.
10advisories on record
10vulnerabilities
0unmaintained notices
0.7.1newest fixed version
Every advisory, newest first
- VulnerabilityGHSA-4v58-8p28-2rq3 · 2026-05-05awslabs/tough is Missing Delegated Metadata Validation
- VulnerabilityGHSA-8m7c-8m39-rv4x · 2026-05-05awslabs/tough Delegated Roles have a Signature Threshold Bypass
- VulnerabilityGHSA-j8x2-777p-23fc · 2025-03-28tough cyclic delegation graphs are not detected
- VulnerabilityGHSA-v4wr-j3w6-mxqc · 2025-03-28tough terminating targets role delegations are not respected
- VulnerabilityGHSA-5vmp-m5v2-hx47 · 2025-03-28tough root metadata version is not checked for sequential versioning
- VulnerabilityGHSA-76g3-38jv-wxh4 · 2025-03-28tough timestamp metadata is cached when it fails snapshot rollback check
- VulnerabilityGHSA-q6r9-r9pw-4cf7 · 2025-03-28tough failure to detect delegated target rollback
- VulnerabilityGHSA-r56q-vv3c-6g9c · 2021-10-19Improper sanitization of delegated role names
- VulnerabilityGHSA-x3r5-q6mj-m485 · 2021-10-19Improper sanitization of target names
- Vulnerability HighRUSTSEC-2020-0024 · 2020-07-09Improper uniqueness verification of signature threshold
Check your version
Run cargo tree -i tough to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.
RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.
Up next
Are you affected?Check your whole dependency treeRead it next →Also worth your time
Did this answer your question?