tokio-rs — Vulnerabilities & Security Advisories 6

Tokio-rs is an asynchronous runtime for Rust, primarily used for building high-performance network applications. Historically, its vulnerabilities have included remote code execution (RCE) and denial-of-service (DoS) flaws, often stemming from unsafe code or improper input validation. The project maintains a strong security focus through Rust's memory safety guarantees, though six CVEs remain on record. Notable incidents include a 2021 RCE vulnerability in the mio crate, which tokio-rs depends on, allowing attackers to execute arbitrary code through crafted file descriptors. The project's rapid development cycle occasionally introduces security regressions, though these are typically addressed quickly through community collaboration and automated testing.