tokio-rs

Products

ProductCVEsExploitedLatest
tokio2–Oct 23, 2026
axum-core1–Sep 14, 2022
bytes1–Feb 4, 2026
mio1–Mar 6, 2024
slab1–Aug 11, 2025
tracing1–Aug 29, 2025

Exploited and recent CVEs

  • CVE-2026-115567 Medium 5.8 Tokio: Race condition in `tokio::time::Interval` 0.1%
  • CVE-2026-25541 Medium 5.5 Bytes is vulnerable to integer overflow in BytesMut::reserve 0.6%
  • CVE-2025-58160 Low 2.3 Tracing logging user input may result in poisoning logs with ANSI escape sequences 0.3%
  • CVE-2025-55159 Medium 5.1 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check 0.2%
  • CVE-2024-27308 High 7.5 Mio's tokens for named pipes may be delivered after deregistration 0.9%
  • CVE-2023-22466 Medium 5.4 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe 0.6%
  • CVE-2022-3212 High 7.5 DoS in axum-core due to missing request size limit 1.0%