Crates-io
1,288 CVEs tracked since 2016. Since Sep 2021, 1 of them reached CISA KEV.
Crates-io CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-09 | 5 | 0 |
| 2021-10 | 4 | 0 |
| 2021-11 | 5 | 0 |
| 2021-12 | 55 | 0 |
| 2022-01 | 3 | 0 |
| 2022-02 | 4 | 0 |
| 2022-03 | 7 | 0 |
| 2022-04 | 6 | 0 |
| 2022-05 | 6 | 0 |
| 2022-06 | 61 | 0 |
| 2022-07 | 7 | 0 |
| 2022-08 | 19 | 0 |
| 2022-09 | 19 | 0 |
| 2022-10 | 5 | 0 |
| 2022-11 | 12 | 0 |
| 2022-12 | 11 | 0 |
| 2023-01 | 9 | 0 |
| 2023-02 | 18 | 0 |
| 2023-03 | no snapshot | |
| 2023-04 | 7 | 0 |
| 2023-05 | 4 | 0 |
| 2023-06 | 11 | 0 |
| 2023-07 | 5 | 0 |
| 2023-08 | 10 | 0 |
| 2023-09 | 17 | 1 |
| 2023-10 | 4 | 0 |
| 2023-11 | 6 | 0 |
| 2023-12 | 11 | 0 |
| 2024-01 | 17 | 0 |
| 2024-02 | 18 | 0 |
| 2024-03 | 15 | 0 |
| 2024-04 | 9 | 0 |
| 2024-05 | 14 | 0 |
| 2024-06 | 6 | 0 |
| 2024-07 | 14 | 0 |
| 2024-08 | 14 | 0 |
| 2024-09 | 11 | 0 |
| 2024-10 | 12 | 0 |
| 2024-11 | 21 | 0 |
| 2024-12 | 23 | 0 |
| 2025-01 | 11 | 0 |
| 2025-02 | 13 | 0 |
| 2025-03 | 18 | 0 |
| 2025-04 | 24 | 0 |
| 2025-05 | 25 | 0 |
| 2025-06 | 15 | 0 |
| 2025-07 | 36 | 0 |
| 2025-08 | 11 | 0 |
| 2025-09 | 16 | 0 |
| 2025-10 | 17 | 0 |
| 2025-11 | 12 | 0 |
| 2025-12 | 12 | 0 |
| 2026-01 | 32 | 0 |
| 2026-02 | 40 | 0 |
| 2026-03 | 50 | 0 |
| 2026-04 | 18 | 0 |
| 2026-05 | 44 | 0 |
| 2026-06 | 10 | 0 |
| 2026-07 | 41 | 0 |
| 2026-08 | 10 | 0 |
| 2026-09 | 9 or fewer | |
| 2026-10 | 15 | 0 |
| 2026-11 | 0 |
Products
The products that kept showing up in Crates-io's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Crates-io.
- GHSA-c33x-vcv4-vg3gCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence—
- GHSA-vp88-798v-h67frustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert—
- GHSA-w44r-93j7-qv28rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share—
- GHSA-c8m5-c952-6cm4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs—
- GHSA-h2v8-394m-p7vvRustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.—
- GHSA-h4fr-cmh5-qr62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root—
- GHSA-q54r-jf2p-rfr2gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()—
- GHSA-6fj4-rcr3-r7rrlopdf has a stack overflow via deeply nested PDF objects—
- GHSA-2mjx-qc3c-rqvcRustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries—
- GHSA-6f2x-v7q7-m7m5hickory-resolver follows irrelevant CNAME records—
- GHSA-6w6g-hm98-mhgmhickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)—
- GHSA-5j98-2g5x-46v6hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures—
- GHSA-cjcg-cxmh-9wcrPraxis affected by HTTP/2 Bomb —
- GHSA-6g2r-675j-hx59xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release—
- GHSA-c9xm-49cp-xcr9rmcp OAuth client fetches server-controlled resource_metadata URLs—
The record
- Peak rank
- #4 in Dec 2020
- Busiest month shown
- Jun 2022, 61 CVEs
- Months with a KEV entry
- 1 since Sep 2021
- Monthly snapshots
- 73 since 2016