Package ecosystem
crates.io package vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 2,374 vulnerabilities in crates.io packages: 19 in the last 7 days and 319 in the last 90 days, 35 of them critical and 1 exploited in the wild. The most recent, CVE-2026-42067, was published on 10 November 2026. 138 vulnerabilities in the last four weeks, up 64% on the four before (84). 3 critical against 0. 177 packages have a page of their own.
- Last 7 days
- 19
- Last 90 days
- 319
- Critical, all time
- 35
- Exploited in the wild
- 1
About crates.io
Package registry for Rust programming language libraries and applications.
crates.io packages
- surrealdb (crates.io)83
- wasmtime (crates.io)67
- deno (crates.io)39
- zebrad (crates.io)27
- russh (crates.io)26
- openssl-src (crates.io)26
- openssl (crates.io)25
- rustfs (crates.io)25
- coreutils (crates.io)21
- ckb (crates.io)19
- apollo-router (crates.io)13
- deepseek-tui (crates.io)13
- diesel (crates.io)13
- pyo3 (crates.io)13
- ammonia (crates.io)12
- rustls (crates.io)12
- zstd-safe (crates.io)12
- wasmtime-wasi (crates.io)11
- astral-tokio-tar (crates.io)10
- quinn-proto (crates.io)10
- surrealdb-core (crates.io)10
- tough (crates.io)10
- gix (crates.io)10
- pingora-core (crates.io)10
- tokio (crates.io)10
- codewhale-tui (crates.io)9
- zip (crates.io)9
- cargo (crates.io)8
- hyper (crates.io)8
- libcrux-ml-dsa (crates.io)8
- nostr (crates.io)8
- rmcp (crates.io)8
- wasmtime-wasi-http (crates.io)8
- cosmwasm-vm (crates.io)7
- gitoxide (crates.io)7
- routinator (crates.io)7
- tauri (crates.io)7
- vaultwarden (crates.io)7
- hickory-proto (crates.io)7
- matrix-sdk-crypto (crates.io)7
- rkyv (crates.io)7
- rustls-webpki (crates.io)7
- actix-http (crates.io)6
- arrow (crates.io)6
- cranelift-codegen (crates.io)6
- aws-lc-sys (crates.io)6
- h2 (crates.io)6
- deno_runtime (crates.io)6
- git2 (crates.io)6
- imageproc (crates.io)6
- internment (crates.io)6
- mise (crates.io)6
- Simple-Wayland-HotKey-Daemon (crates.io)6
- bottlerocket/update-operator (crates.io)5
- comrak (crates.io)5
- sequoia-openpgp (crates.io)5
- crossbeam (crates.io)5
- crossbeam-channel (crates.io)5
- nimiq-primitives (crates.io)5
- pgp (crates.io)5
- quiche (crates.io)5
- slice-deque (crates.io)5
- smallvec (crates.io)5
- sudo-rs (crates.io)5
- users (crates.io)5
- wasm3 (crates.io)5
- zeptoclaw (crates.io)5
- actix-web (crates.io)4
- array-macro (crates.io)4
- arrow2 (crates.io)4
- cggmp21 (crates.io)4
- gix-transport (crates.io)4
- gix-worktree-state (crates.io)4
- inventory (crates.io)4
- ntpd (crates.io)4
- s2n-quic (crates.io)4
- spin (crates.io)4
- tar (crates.io)4
- evm (crates.io)4
- fast-float (crates.io)4
- flatbuffers (crates.io)4
- gitoxide-core (crates.io)4
- hpke-rs (crates.io)4
- hyper-staticfile (crates.io)4
- libcrux-sha3 (crates.io)4
- libpulse-binding (crates.io)4
- lru (crates.io)4
- nimiq-blockchain (crates.io)4
- nostr-relay-pool (crates.io)4
- oqs (crates.io)4
- pleaser (crates.io)4
- postgres-protocol (crates.io)4
- pqc_kyber (crates.io)4
- risc0-zkvm (crates.io)4
- salvo (crates.io)4
- solana_rbpf (crates.io)4
- tower-http (crates.io)4
- triton-vm (crates.io)4
- vodozemac (crates.io)4
- xcb (crates.io)4
- zebra-chain (crates.io)4
- zebra-network (crates.io)4
- zebra-script (crates.io)4
- zebra-state (crates.io)4
- actix-files (crates.io)3
- anchor-lang (crates.io)3
- anoncreds-clsignatures (crates.io)3
- apache-avro (crates.io)3
- append-only-vec (crates.io)3
- arenavec (crates.io)3
- array-queue (crates.io)3
- arrayref (crates.io)3
- async-graphql (crates.io)3
- atty (crates.io)3
- bumpalo (crates.io)3
- capnp (crates.io)3
- gix-worktree (crates.io)3
- hickory-resolver (crates.io)3
- hpack (crates.io)3
- lettre (crates.io)3
- mongodb (crates.io)3
- ncurses (crates.io)3
- orion (crates.io)3
- protobuf (crates.io)3
- s2n-tls (crates.io)3
- static-web-server (crates.io)3
- webp (crates.io)3
- zstd (crates.io)3
- crayon (crates.io)3
- enum-map (crates.io)3
- evm-core (crates.io)3
- generator (crates.io)3
- gix-index (crates.io)3
- gix-path (crates.io)3
- grin (crates.io)3
- hubuum_client (crates.io)3
- id-map (crates.io)3
- im (crates.io)3
- intaglio (crates.io)3
- juniper (crates.io)3
- lemmy_api (crates.io)3
- libcrux-aesgcm (crates.io)3
- libcrux-ed25519 (crates.io)3
- libgit2-sys (crates.io)3
- libp2p-core (crates.io)3
- libsecp256k1 (crates.io)3
- matrix-sdk (crates.io)3
- memoffset (crates.io)3
- metacall (crates.io)3
- ml-dsa (crates.io)3
- namada-apps (crates.io)3
- oneringbuf (crates.io)3
- ouch (crates.io)3
- pallet-ethereum (crates.io)3
- proc-macro1 (crates.io)3
- ring (crates.io)3
- ruint (crates.io)3
- rust-crypto (crates.io)3
- rustc-serialize (crates.io)3
- ruzstd (crates.io)3
- scratchpad (crates.io)3
- sized-chunks (crates.io)3
- skiplist (crates.io)3
- slack-morphism (crates.io)3
- sm2 (crates.io)3
- sodiumoxide (crates.io)3
- toodee (crates.io)3
- traitobject (crates.io)3
- trust-dns-server (crates.io)3
- unicycle (crates.io)3
- unsafe-libyaml (crates.io)3
- ursa (crates.io)3
- yamux (crates.io)3
- youki (crates.io)3
- zebra-consensus (crates.io)3
- zebra-rpc (crates.io)3
- zerocopy (crates.io)3
Latest crates.io package vulnerabilities
- CVE-2026-42067: Intel TDX Workload Attestation certificate validation bypassmediumCVSS 4EPSS 0.1%
- CVE-2026-40693: Intel TDX Workload Attestation Software input validation denial of servicemediumCVSS 4EPSS 0.1%
- lwd-uri-util malicious code in Rust crateinfo
- gabby-types-sec malicious code in Rust crateinfo
- env-test-guard malicious code in Rust crateinfo
- electrumd malicious build-time telemetry exfiltrationinfo
- webhook_commands malicious code in Rust crateinfo
- Rust crate shinchina malicious code in build environment telemetryinfo
- vodozemac Olm key ratchet memory exposureinfo
- actix-http unbounded decompression denial of serviceinfo
- sec-gemini malicious code in Rust crateinfo
- actix-http request smuggling through malformed chunked trailersinfo
- actix-http memory exhaustion via large-window Brotliinfo
- top_level_crate malicious code with telemetry exfiltrationinfo
- actix-web denial of service via compressed request bodiesinfo
- vodozemac degraded secret zeroization in cryptographic librariesinfo
- actix-files hidden file disclosure through Windows short namesinfo
- shinchina-test malicious code in Rust crateinfo
- build_dep malicious code in Rust crateinfo
- CVE-2026-111062: russh SSH server signature algorithm mismatch in publickey authmediumCVSS 4
- ocipkg library unmaintainedinfo
- RUSTSEC-2026-0462 - Unbounded response body buffering in Streamable HTTP clientslowCVSS 3.1
- RUSTSEC-2026-0460 - Panic on chroma QP offsets enabled with an empty offset listlowCVSS 3.1
- RUSTSEC-2026-0456 - Panic on an HEVC tile layout that does not match the active SPSlowCVSS 3.1
- RUSTSEC-2026-0458 - Memory exhaustion when parsing a crafted `iloc` boxlowCVSS 3.1
Most severe crates.io package vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-4863: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTablecriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2026-46695: boxlite-ai Boxlite read-only volume bypass via CAP_SYS_ADMINcriticalCVSS 10EPSS 0.5%
- CVE-2025-62596: youki container escape and denial of service due to arbitrary write gadgets and procfs write redirectscriticalCVSS 10EPSS 0.3%
- CVE-2025-62161: youki container escape via "masked path" abuse due to mount race conditionscriticalCVSS 10EPSS 0.3%
- CVE-2026-115893: Wasmtime Cranelift aarch64 br_table sandbox escapecriticalCVSS 9.9EPSS 1.0%
- CVE-2026-115889: Wasmtime Cranelift SSA value index overflowcriticalCVSS 9.9EPSS 0.4%
- CVE-2026-34987: Bytecode Alliance Wasmtime sandbox escape in Winch compiler backendcriticalCVSS 9.9EPSS 0.3%
- CVE-2025-68705: RustFS Path Traversal VulnerabilitycriticalCVSS 9.8EPSS 7.3%
- CVE-2018-25024: actix-web memory corruption via unsound reference coercioncriticalCVSS 9.8EPSS 1.3%
- CVE-2026-77651: arrayref crate malicious dependency code execution at build timecriticalCVSS 9.8EPSS 0.8%
Vulnerabilities per week
138 vulnerabilities in the last four weeks, up 64% on the four before (84). 3 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 41 | 5 | |
| 24 Aug 2026 | 21 | 0 | |
| 31 Aug 2026 | 11 | 0 | |
| 7 Sep 2026 | 14 | 0 | |
| 14 Sep 2026 | 27 | 0 | |
| 21 Sep 2026 | 22 | 0 | |
| 28 Sep 2026 | 23 | 0 | |
| 5 Oct 2026 | 12 | 0 | |
| 12 Oct 2026 | 46 | 0 | |
| 19 Oct 2026 | 29 | 2 | |
| 26 Oct 2026 | 40 | 1 | |
| 2 Nov 2026 | 23 | 0 | |
| 9 Nov 2026 | 7 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many crates.io package vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/crates-io)<a href="https://junglewise.ai/threats/vendors/crates-io"><img src="https://junglewise.ai/threats/vendors/crates-io/badge.svg" alt="crates.io package vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/crates-io.json, and this page as text at https://junglewise.ai/threats/vendors/crates-io.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "crates.io package vulnerabilities", https://junglewise.ai/threats/vendors/crates-io, 13 November 2026.