- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 39
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 1 days
Acknowledgement is targeted at 24 hours and a detailed response at 48
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 5 excluded.
Web 1
- https://www.rust-lang.org
Products and areas 8
- Cargo end to end: dependency resolution, registry protocol handling, lockfile behaviour, build script execution and the credential handling for registry tokens
- docs.rs as a live service, named in the scope statement alongside the other project domains
- rust-analyzer and the published IDE extensions, which open a project's files and configuration on a developer's machine
- rustc itself, including code generation, since no miscompilation carve-out is published here
- rustup, including toolchain download, signature and checksum verification, and the installer people run from a shell one-liner
- The project-owned crates on crates.io that the scope statement covers, and the behaviour their consumers inherit
- The published scope is wide and stated explicitly: rustc, Cargo, rust-analyzer and everything distributed through rustup, the rust-lang.org, rustup.rs, docs.rs and rfcbot.rs domains, every crate owned by @rust-lang-owner on crates.io, and the IDE extensions the project publishes to the VS Marketplace and Open VSX
- The standard library, above all soundness holes letting safe code cause undefined behaviour
Out of scope (5)
- Anything outside the named domains, repositories and crates, since this policy draws a generous but explicit perimeter
- Downstream misuse of a standard library API whose safety requirements are correctly documented
- Findings in code merely written in Rust rather than in the toolchain the project ships
- The internals and users forums, also excluded by name
- Third-party crates, excluded by name. A vulnerability in somebody else's crate belongs to that author
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Email the address on the policy page .
-
Lead with the impact rather than with the wrong output
-
hold the detail until the signed announcement is out
Not accepted
-
Third-party crates
-
The internals and users forums
-
Findings in code merely written in Rust rather than in the toolchain the project ships
-
Downstream misuse of a standard library API whose safety requirements are correctly documented
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-5222 | Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the | Low 2.3 | 25 May 2026 |
| CVE-2026-5223 | Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink. | Medium 6.5 | 25 May 2026 |
| CVE-2024-43402 | Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rule | High 8.1 | 4 Sep 2024 |
| CVE-2024-3566 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. | Critical 9.8 | 10 Apr 2024 |
| CVE-2024-24576 | Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. Th | Critical 10.0 | 9 Apr 2024 |
| CVE-2023-40030 | Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somew | Medium 6.1 | 24 Aug 2023 |
| CVE-2023-38497 | Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the cur | High 7.9 | 4 Aug 2023 |
| CVE-2022-46176 | Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't ex | Medium 5.3 | 11 Jan 2023 |
| CVE-2022-36113 | Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allow | Medium 4.6 | 14 Sep 2022 |
| CVE-2022-36114 | Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size (also known as a "zip bomb"), exhausting the disk space on the machine using Cargo to download the package. Note that by | Medium 4.8 | 14 Sep 2022 |
| CVE-2022-24713 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a | High 7.5 | 8 Mar 2022 |
| CVE-2022-21658 | Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and di | High 7.3 | 20 Jan 2022 |
| CVE-2021-29922 | library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. | Critical 9.1 | 7 Aug 2021 |
| CVE-2018-25008 | In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions. | Medium 5.9 | 14 Apr 2021 |
| CVE-2020-36323 | In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked. | High 8.2 | 14 Apr 2021 |
| CVE-2021-31162 | In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. | Critical 9.8 | 14 Apr 2021 |
| CVE-2017-20004 | In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types, allowing for memory safety issues through race conditions. | Medium 5.9 | 14 Apr 2021 |
| CVE-2020-36318 | In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free. | Critical 9.8 | 11 Apr 2021 |
| CVE-2021-28875 | In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow. | High 7.5 | 11 Apr 2021 |
| CVE-2021-28876 | In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait. | Medium 5.3 | 11 Apr 2021 |
| CVE-2021-28877 | In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait. | High 7.5 | 11 Apr 2021 |
| CVE-2021-28878 | In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait. | High 7.5 | 11 Apr 2021 |
| CVE-2021-28879 | In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again. | Critical 9.8 | 11 Apr 2021 |
| CVE-2015-20001 | In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation. | High 7.5 | 11 Apr 2021 |
| CVE-2020-36317 | In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string. | High 7.5 | 11 Apr 2021 |
| CVE-2020-36202 | An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy. | Medium 6.1 | 26 Jan 2021 |
| CVE-2020-26297 | mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an a | High 8.2 | 4 Jan 2021 |
| CVE-2020-35920 | An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation. | Medium 5.5 | 31 Dec 2020 |
| CVE-2020-35908 | An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled. | Medium 5.5 | 31 Dec 2020 |
| CVE-2020-35905 | An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code). | Medium 4.7 | 31 Dec 2020 |
| CVE-2020-35906 | An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation. | High 7.8 | 31 Dec 2020 |
| CVE-2020-35907 | An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference. | Medium 5.5 | 31 Dec 2020 |
| CVE-2020-26281 | async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent r | Medium 6.8 | 21 Dec 2020 |
| CVE-2019-16760 | Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests | Medium 4.6 | 30 Sep 2019 |
| CVE-2019-1010299 | The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed ve | Medium 5.3 | 15 Jul 2019 |
| CVE-2019-12083 | The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually impl | High 8.1 | 13 May 2019 |
| CVE-2018-1000810 | The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1 | Critical 9.8 | 8 Oct 2018 |
| CVE-2018-1000657 | Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in a | High 7.8 | 20 Aug 2018 |
| CVE-2018-1000622 | The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1. | High 7.8 | 9 Jul 2018 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview Rust's toolchain is now infrastructure. rustc, cargo and rustup build code shipping in the Linux kernel, Android, Windows components, Firefox and a large share of new systems software. The declared scope is unusually wide for a compiler project: it covers everything rustup distributes, the project's web properties including docs.rs, and every crate the project owns on crates.io. That makes the productive surface supply chain rather than codegen, since cargo and rustup decide which code a build downloads and runs. The Rust Foundation funds security engineering work and pays external reporters nothing, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The published scope is wide and stated explicitly: rustc, Cargo, rust-analyzer and everything distributed through rustup, the rust-lang.org , rustup.rs , docs.rs and rfcbot.rs domains, every crate owned by @rust-lang-owner on crates.io, and the IDE extensions the project publishes to the VS Marketplace and Open VSX Cargo end to end: dependency resolution, registry protocol handling, lockfile behaviour, build script execution and the credential handling for registry tokens rustup, including toolchain download, signature and checksum verification, and the installer people run from a shell one-liner The standard library, above all soundness holes letting safe code cause undefined behaviour rustc itself, including code generation, since no miscompilation carve-out is published here rust-analyzer and the published IDE extensions, which open a project's files and configuration on a developer's machine docs.rs as a live service, named in the scope statement alongside the other project domains The project-owned crates on crates.io that the scope statement covers, and the behaviour their consumers inherit Out of scope Third-party crates, excluded by name. A vulnerability in somebody else's crate belongs to that author The internals and users forums, also excluded by name Findings in code merely written in Rust rather than in the toolchain the project ships Downstream misuse of a standard library API whose safety requirements are correctly documented Anything outside the named domains, repositories and crates, since this policy draws a generous but explicit perimeter Most-valued findings Supply-chain defects in cargo and rustup. This is where the advisory record actually sits, and a single bug there reaches every Rust build on the planet Toolchain download or verification bypass in rustup, since it installs a compiler that then runs with the developer's privileges Registry and dependency-resolution behaviour in cargo making a build fetch or execute code it was never asked to Credential handling for registry tokens, including anything that leaks one into a log, a cache or a build artifact Standard library soundness holes reachable from safe code, since safe code being unable to do this is the entire value proposition Compromise of a project-owned service in scope, particularly anything that influences what a published artifact contains Code generation defects with demonstrated security impact, an open class here because the project publishes no miscompilation exemption Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] . Acknowledgement is targeted at 24 hours and a detailed response at 48 Advisories go out signed with the Rust security team PGP key, published on rust-lang.org under /static/keys/ The scope is broad: rustc, Cargo, rust-analyzer and everything rustup distributes, plus the project's domains, its crates.io-owned crates and its published IDE extensions Third-party crates are out of scope by name, as are the internals and users forums There is no published miscompilation carve-out here, unlike GCC and LLVM, so a codegen finding is worth sending. Lead with the impact rather than with the wrong output There is no reward. Rust Foundation security funding goes to engineering work and not to reporters Disclosure Coordinated with the Rust security team by email, with acknowledgement targeted at 24 hours and a substantive response at 48. Announcements are published signed with the team's PGP key. Expect the embargo to run to whichever release carries the fix, and hold the detail until the signed announcement is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability