How many CVEs have a located fix in rust-lang/rust?

18 published CVEs have a fix traced to functions in rust-lang/rust, touching 45 functions across 35 files.

Which function in rust-lang/rust has been patched by the most CVEs?

checked_mul in library/alloc/src/str.rs has been changed by 2 CVE fixes, from 2021 to 2021.

How large is a typical CVE fix in rust-lang/rust?

The median fix changes 34 lines. 33% of fixes change 20 lines or fewer, and 33% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

rust

#303 of 500 repositories

rust-lang/rust

Name: rust-lang/rust: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 1, 2025

18

CVE fixes located

Published CVEs

45

Functions patched

Distinct function sites

35

Files patched

Distinct source files

2018–2025

Years covered

By CVE publication date

Overview

18 published CVEs have a fix traced to functions in rust-lang/rust, the earliest published in 2018. Those fixes changed 45 distinct functions across 35 files, in 125 patch hunks.

Among the 500 repositories tracked here, rust-lang/rust ranks #303 by the number of CVEs with a located fix.

Most patched functions

Functions in rust-lang/rust changed by the most CVE fixes.

Most patched files

Files in rust-lang/rust changed by the most CVE fixes.

1library/core/src/iter/adapters/zip.rs4 CVEs · 3 functions
2library/alloc/src/str.rs2 CVEs · 1 functions
3library/std/src/sys/unix/fs.rs1 CVEs · 6 functions
4library/std/src/sys/windows/c.rs1 CVEs · 5 functions
5library/std/src/sys/wasi/fs.rs1 CVEs · 4 functions
6src/liballoc/collections/vec_deque.rs1 CVEs · 4 functions
7library/std/src/net/parser.rs1 CVEs · 2 functions
8library/std/src/path.rs1 CVEs · 2 functions
9library/std/src/sys/windows/fs.rs1 CVEs · 2 functions
10src/libcollections/binary_heap.rs1 CVEs · 2 functions

Fix size

How much code a CVE fix in rust-lang/rust changes, with backports counted once.

34

Median lines changed

Added plus removed, per CVE

33%

Fixes of 20 lines or fewer

Share of CVE fixes

33%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in rust-lang/rust, and the functions each fix changed.

Rust standard library didn't detect all path separators on Cygwin
CVE-2025-11233PrefixParser is_sep_byte PathBuf
Medium · CVSS 6.3
EPSS 0.5%2025-10-01
CVE-2022-21658
CVE-2022-21658chroot basic_info open_link
High · CVSS 7.3
EPSS 1.4%2022-01-20
CVE-2021-29922
CVE-2021-29922match peek_char IpAddr
Critical · CVSS 9.1
EPSS 2.6%2021-08-07
Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
CVE-2021-32715match test_leading_plus
Medium · CVSS 5.3
EPSS 1.1%2021-07-07
CVE-2017-20004
CVE-2017-20004MutexGuard NonCopy
Medium · CVSS 5.9
EPSS 0.8%2021-04-14
CVE-2020-36323
CVE-2020-36323checked_mul
High · CVSS 8.2
EPSS 2.0%2021-04-14
CVE-2018-25008
CVE-2018-25008
Medium · CVSS 5.9
EPSS 1.1%2021-04-14
CVE-2021-31162
CVE-2021-31162checked_mul
Critical · CVSS 9.8
EPSS 2.9%2021-04-14
CVE-2015-20001
CVE-2015-20001Hole sift_up
High · CVSS 7.5
EPSS 1.3%2021-04-11
CVE-2020-36317
CVE-2020-36317String
High · CVSS 7.5
EPSS 1.5%2021-04-11
CVE-2020-36318
CVE-2020-36318is_contiguous
Critical · CVSS 9.8
EPSS 1.7%2021-04-11
CVE-2021-28876
CVE-2021-28876
Medium · CVSS 5.3
EPSS 1.6%2021-04-11

Get an alert for each new rust-lang/rust CVE, with the patched functions and AI-written analysis.

Monitor rust CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/roller18 CVEs chatwoot/chatwoot18 CVEs containerd/containerd18 CVEs debian/ntfs-3g18 CVEs decidim/decidim18 CVEs dompdf/dompdf18 CVEs facebook/hermes18 CVEs frangoteam/FUXA18 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in rust-lang/rust.

How many CVEs have a located fix in rust-lang/rust?: 18 published CVEs have a fix traced to functions in rust-lang/rust, touching 45 functions across 35 files.
Which function in rust-lang/rust has been patched by the most CVEs?: checked_mul in library/alloc/src/str.rs has been changed by 2 CVE fixes, from 2021 to 2021.
How large is a typical CVE fix in rust-lang/rust?: The median fix changes 34 lines. 33% of fixes change 20 lines or fewer, and 33% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track rust-lang/rust CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing