Rust

Vendor:

First CVE: Jul 9, 2018 · Active for 8 years

24
Total CVEs
More Total CVEs than 95% of tracked products
4.0
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.9
Avg CVSS
Higher Avg CVSS than 68% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Rust over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jul 9, 2018
8 years ago
Most Recent CVE
Sep 4, 2024
689 days ago

CVE Severity & Scoring

Rust24 CVEs
All CVEs352,708 CVEs
MediumHighCritical
Attack Vector
Local4 (16.7%)
Network20 (83.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low20 (83.3%)
High4 (16.7%)
Unknown0 (0.0%)
User Interaction
None22 (91.7%)
Unknown0 (0.0%)
Required2 (8.3%)
Privileges Required
Low3 (12.5%)
High0 (0.0%)
None21 (87.5%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (24 CVEs).

24 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2024-24576CRITICAL
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking ba
Apr 9, 202410.046NONO
CVE-2024-3566CRITICAL
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific condit
Apr 10, 20249.833NONO
CVE-2021-28879CRITICAL
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consume
Apr 11, 20219.832NONO
CVE-2018-1000810CRITICAL
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerabil
Oct 8, 20189.832NONO
CVE-2021-31162CRITICAL
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.
Apr 14, 20219.831NONO
CVE-2020-36318CRITICAL
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use
Apr 11, 20219.831NONO
CVE-2021-29922CRITICAL
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allow
Aug 7, 20219.130NONO
CVE-2024-43402HIGH
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior
Sep 4, 20248.827NONO
CVE-2018-1000657HIGH
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnera
Aug 20, 20187.827NONO
CVE-2020-36323HIGH
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrow
Apr 14, 20218.226NONO
View all 24 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (24 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (24 CVEs).

Media Mentions

Signals from CVEs in this product scope (24 CVEs).

Top CNAs Publishing CVEs For Rust

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
1.29.019.83.0%00
1.28.019.83.0%00
1.27.219.83.0%00
1.27.119.83.0%00
1.27.019.83.0%00
1.26.219.83.0%00
1.26.119.83.0%00
1.26.019.83.0%00