The Rust Project
First CVE: Oct 1, 2025Active for: 1 year
3
CVEs Published
More CVEs Published than 9% of tracked CNAs
1.5
Avg CVEs / Year
More Avg CVEs / Year than 8% of tracked CNAs
6.0
Avg CVSS Score
Higher Avg CVSS Score than 9% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Trends Over Time
The number and severity of CVEs published by The Rust Project over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 1, 2025
9 months ago
Most Recent CVE
May 25, 2026
60 days ago
Top CVEs
All CVEs published by The Rust Project as a CNA, regardless of affected vendor or product.
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-5222MEDIUM Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hoste | May 25, 2026 | 6.5 | 32 | NO | NO |
CVE-2026-5223MEDIUM Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the | May 25, 2026 | 5.3 | 29 | NO | NO |
CVE-2025-11233MEDIUM Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to | Oct 1, 2025 | 6.3 | 22 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA3 CVEs
100%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
Medium
Attack Vector
Local0 (0.0%)
Network3 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low1 (33.3%)
High0 (0.0%)
None2 (66.7%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (3 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by The Rust Project as a CNA.
Media Mentions
Media articles that mention a CVE ID published by The Rust Project as a CNA — matched by CVE ID, not by organization name.