Rust bug bounty programs
rust-lang.org Updated
Rust runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 26
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Rust toolchain
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Rust toolchain
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | 24 hours promised | Open |
|
Rust
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | 24 hours promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
- First response
- 24 hours promised
-
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
26 targets across all 2 programs, each listed once with the programs that cover it. 9 excluded.
-
All extensions in the Open VSX registry published by rust-lang
Products and areas
Covered by Self-hosted
-
All extensions in the Visual Studio Marketplace published by rust-lang
Products and areas
Covered by Self-hosted
-
Cargo end to end: dependency resolution, registry protocol handling, lockfile behaviour, build script execution and the credential handling for registry tokens
Products and areas
Covered by Sorona
-
docs.rs as a live service, named in the scope statement alongside the other project domains
Products and areas
Covered by Sorona
-
rust-analyzer and the published IDE extensions, which open a project's files and configuration on a developer's machine
Products and areas
Covered by Sorona
-
rustc itself, including code generation, since no miscompilation carve-out is published here
Products and areas
Covered by Sorona
-
rustup, including toolchain download, signature and checksum verification, and the installer people run from a shell one-liner
Products and areas
Covered by Sorona
-
The project-owned crates on crates.io that the scope statement covers, and the behaviour their consumers inherit
Products and areas
Covered by Sorona
-
The published scope is wide and stated explicitly: rustc, Cargo, rust-analyzer and everything distributed through rustup, the rust-lang.org, rustup.rs, docs.rs and rfcbot.rs domains, every crate owned by @rust-lang-owner on crates.io, and the IDE extensions the project publishes to the VS Marketplace and Open VSX
Products and areas
Covered by Sorona
-
The standard library, above all soundness holes letting safe code cause undefined behaviour
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 9
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
internals.rust-lang.org
Self-hosted
-
users.rust-lang.org
Self-hosted
-
Anything outside the named domains, repositories and crates, since this policy draws a generous but explicit perimeter
Sorona
-
Downstream misuse of a standard library API whose safety requirements are correctly documented
Sorona
-
Findings in code merely written in Rust rather than in the toolchain the project ships
Sorona
-
The internals and users forums, also excluded by name
Sorona
-
The internals.rust-lang.org and users.rust-lang.org domains.
Self-hosted
-
Third-party crates, excluded by name. A vulnerability in somebody else's crate belongs to that author
Sorona
-
Third-party packages published on crates.io .
Self-hosted
Recent changes
Reward and scope changes across every Rust program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Rust products, from the NVD.
-
CVE-2026-5222 Low
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the
-
CVE-2026-5223 Medium
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
-
CVE-2026-5223 Medium
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
-
CVE-2026-5222 Low
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the
-
CVE-2024-43402 High
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rule
-
CVE-2024-43402 High
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rule
-
CVE-2024-3566 Critical
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
-
CVE-2024-3566 Critical
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
About this page
This page gathers every public program listed under rust-lang.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.