debian/rust-tokio vulnerabilities

Latest debian/rust-tokio CVEs

Newest publication first

1. CVE-2026-115567 Tokio: Race condition in `tokio::time::Interval`

   Published 2026-10-23

   Medium·CVSS 5.8 EPSS 0.11%

   Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that...

2. CVE-2023-22466 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

   Published 2023-01-04

   Medium·CVSS 5.4 EPSS 0.61%

   Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously config...

3. CVE-2021-45710 Race Condition in tokio

   Published 2021-12-26

   High·CVSS 8.1 EPSS 1.2%

   An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.

4. CVE-2021-38191 Race condition in tokio

   Published 2021-08-08

   Medium·CVSS 5.9 EPSS 0.83%

   An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.