Servo vulnerabilities
We track 2 vulnerabilities in Servo products across 3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 26, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Servo vulnerabilities
- 7.3 High severity
smallbitvec: Heap-based Buffer Overflow
smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs onl
- 8.8 High severity
rust-url: Cross-Site Request Forgery
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to anothe