Tokio is an asynchronous runtime library for Rust that underpins concurrent systems and networking applications across the ecosystem, despite its narrow product footprint. Its vulnerability profile centers on concurrency primitives and resource-lifecycle management, with recurring signals in race conditions, improper initialization, use-after-free, and post-release resource operations that reflect the complexity of async-safe state handling in a memory-safe language. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tokio over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-45710HIGH An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a d | Dec 27, 2021 | 8.1 | 27 | NO | NO |
CVE-2024-27308CRITICAL Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already bee | Mar 6, 2024 | 9.1 | 24 | NO | NO |
CVE-2020-35875HIGH An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly. | Dec 31, 2020 | 7.5 | 24 | NO | NO |
CVE-2021-38191MEDIUM An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. | Aug 8, 2021 | 5.9 | 21 | NO | NO |
CVE-2023-22466MEDIUM Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, s | Jan 4, 2023 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tokio.
Media articles that mention a CVE ID that affects a product developed by Tokio — matched by CVE ID, not by vendor name.