Tokio-rs vulnerabilities
We track 3 vulnerabilities in Tokio-rs products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 4, 2026.
Latest Tokio-rs vulnerabilities
- 7.5 High severity
bytes: Integer Overflow to Buffer Overflow
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unc
- 9.1 Critical severity
mio: Use After Free
Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends o
- 7.5 High severity
axum-core: Allocation of Resources Without Limits or Throttling
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This a