Reading a RustSec advisory before you panic

What the database is

The RustSec Advisory Database is a repository of security advisories filed against crates published on crates.io, maintained by the Rust Secure Code Working Group. The cargo-audit tool reads your Cargo.lock and reports any locked crate version that an advisory covers, with the advisory ID, the date and a recommended upgrade.

That lockfile is the point for AI projects. A model server or an agent tool lists far more crates than its authors chose by hand, and the transitive ones are the ones nobody remembers adding.

Four fields to read first

The advisory format is a small block of TOML followed by a Markdown description. These are the fields that decide whether you act:

• id. The form is RUSTSEC-YYYY-NNNN. It is the thing to quote in a ticket.
• versions.patched. The versions that include the fix. This is your upgrade target.
• unaffected. Versions that were never vulnerable. If your lockfile already sits in this range, the alert does not apply to you.
• informational. Present when the advisory is not a vulnerability report in the usual sense. The values are unsound, unmaintained and notice.

Two more are worth a glance. aliases carries other identifiers such as a CVE number, so you can match the alert to a scanner that uses those. A withdrawn date means the advisory was retracted.

What the informational labels mean

unmaintained says the crate is no longer maintained. It does not say the crate is exploitable today, but it does say a future bug will have no upstream fix. unsound marks a soundness issue, which means code that looks safe may not be. notice is everything else.

A short order of response

1. Compare the locked version with patched and unaffected. If it is inside unaffected, stop.
2. Read the informational label. A plain vulnerability with a patched version is a different job from an unmaintained crate with no replacement.
3. Ask whether your code reaches the affected part. The description names the function or feature, and a dependency pulled in for one unrelated helper may never touch it.
4. If a patched version exists, update just that crate with cargo update -p <crate>, rebuild and run your tests.
5. If there is no patch, write down the decision and the date you will look again.

Steps 3 to 5 are our practice, not RustSec’s. The advisory tells you what is wrong; whether it matters in your service is your call.