DockerState

Home › Language runtimes › rust › 1

rust:1

The Rust toolchain (rustc and cargo), tag 1, built on Debian 13.7 (trixie). Pushed to Docker Hub 4 days ago.

Critical 16High 445Medium 1481Low 1833Unknown 41Starts as root7 platforms

602 MBdownload (compressed)
1,688 MBunpacked on disk
5filesystem layers
455packages
24,010files
docker pull rust:1rust@sha256:09027f873d45b8ecd1dc86f1fa13b7a62b875c961f017a0e331267b350430137

Size per platform

Compressed download size on Docker Hub for each architecture.

  • riscv64737 MB
  • ppc64le683 MB
  • s390x652 MB
  • i386635 MB
  • amd64602 MB
  • arm/v7588 MB
  • arm64557 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/local/rustup621 MB
  • /usr/lib/x86_64-linux-gnu405 MB
  • /usr/bin119 MB
  • /usr/libexec/gcc105 MB
  • /usr/share/locale94 MB
  • /usr/share/doc50 MB
  • /usr/lib/gcc26 MB
  • /usr/lib/python326 MB
  • /usr/lib/python3.1326 MB
  • /usr/lib/git-core25 MB

Layers

The 5 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 49 MB# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200'
  2. 26 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates curl gnupg netbase sq wget ; apt-get dist-clean # buildkit
  3. 68 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends git mercurial openssh-client subversion procps ; apt-get dist-clean # buildkit
  4. 237 MBRUN /bin/sh -c set -ex; apt-get update; apt-get install -y --no-install-recommends autoconf automake bzip2 default-libmysqlclient-dev dpkg-dev file g++ gcc imagemagick libbz2-dev libc6-dev libcurl4-openssl-dev libdb-dev libevent-dev libffi-dev libgdbm-dev libglib2.0-dev libgmp-dev libjpeg-dev libkrb5-dev liblzma-dev libmagickcore-dev libmagickwand-dev libmaxminddb-dev libncurses5-dev libncursesw5-dev libpng-dev libpq-dev libreadline-dev libsqlite3-dev libssl-dev libtool libwebp-dev libxml2-dev libxslt-dev libyaml-dev m
  5. 222 MBRUN /bin/sh -c set -eux; arch="$(dpkg --print-architecture)"; case "$arch" in 'amd64') rustArch='x86_64-unknown-linux-gnu'; rustupSha256='5be191e8c70a5007074254cb74d78dbfdd25cd5a61c27de7b8e5410122ec24f4'; ;; 'armhf') rustArch='armv7-unknown-linux-gnueabihf'; rustupSha256='fb8cc6c0ff713fd405a6940c80138516da9b75e6649e280cb65342afa3dcf188'; ;; 'arm64') rustArch='aarch64-unknown-linux-gnu'; rustupSha256='a9c168dbea81a84671c6b7a5c1795cb0eb699020110d107ddfca427bd797e697

Known vulnerabilities

16Critical0 with a fix
445High156 with a fix
1481Medium260 with a fix
1833Low52 with a fix
41Unknown0 with a fix

3816 findings across 455 packages; 468 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2026-42216OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
Critical CVE-2026-42217OpenEXR: OpenEXR: Information disclosure via malformed EXR image file processing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
Critical CVE-2026-44172mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() libmariadb-dev, libmariadb-dev-compat, libmariadb3, mariadb-commoninstalled 1:11.8.6-0+deb13u1 no fix yet
Critical CVE-2026-49261mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd libmariadb-dev, libmariadb-dev-compat, libmariadb3, mariadb-commoninstalled 1:11.8.6-0+deb13u1 no fix yet
Critical CVE-2026-60002openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side openssh-clientinstalled 1:10.0p1-7+deb13u4 no fix yet
Critical CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free libxml2, libxml2-devinstalled 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
Critical CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2026-106565ImageMagick: ImageMagick: Denial of Service via missing end-of-file check in bzip2 images imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106567ImageMagick: ImageMagick: Denial of Service via crafted PSD file imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106573ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106576ImageMagick: ImageMagick: Denial of Service via crafted XMP profile imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106578ImageMagick: ImageMagick: Denial of Service via invalid memory free in MVG decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106579ImageMagick: ImageMagick: Information disclosure via security policy bypass imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106580ImageMagick: ImageMagick: Information disclosure via missing security policy check in CUT encoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-107209ImageMagick: ImageMagick: Denial of Service via crafted RSVG image imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-86420ImageMagick: ImageMagick: Denial of Service due to memory budget exhaustion imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-86421ImageMagick: ImageMagick: Denial of Service via memory leak in MSL decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-93589ImageMagick: ImageMagick: Denial of Service via division by zero in FLIF encoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-93590ImageMagick: ImageMagick: Denial of Service via UHDR encoder policy bypass imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2021-3847kernel: low-privileged user privileges escalation linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2024-58015kernel: wifi: ath12k: Fix for out-of bound access error linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-12495OpenEXR: OpenEXR: Remote Code Execution via malicious EXR file parsing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-12839OpenEXR: OpenEXR: Remote Code Execution via Heap-based Buffer Overflow in EXR File Parsing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-12840OpenEXR: OpenEXR: Remote Code Execution via EXR file parsing heap-based buffer overflow libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-38137kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38187kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38421kernel: platform/x86/amd: pmf: Use device managed allocations linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38636kernel: rv: Use strings in da monitors tracepoints linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39859kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39862kernel: wifi: mt76: mt7915: fix list corruption after hardware restart linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39958kernel: iommu/s390: Make attach succeed when the device was surprise removed linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-40025kernel: f2fs: fix to do sanity check on node footer for non inode dnode linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-64181openexr: Use of Uninitialized Memory inside generic_unpack libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-68174kernel: Linux kernel AMD KFD: Race condition causes system crash linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-68735kernel: Kernel: Privilege escalation via use-after-free in drm/panthor linux-libc-devinstalled 6.12.113-1 no fix yet

Showing the 40 most severe of 1,450 distinct vulnerabilities (3816 findings, one per affected package).

Packages

Debian packages
455

Image configuration

Base OS
Debian 13.7 (trixie)
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
—
Command
bash
Exposed ports
none
Image created
2026-10-28
amd64 digest
sha256:d841af61827b29b3efa46f5363e8f2e972b379cc0463c319e8f320d9f0c8eb0c

Other Rust tags

rust:1-slim927 MB unpacked · 327 MB downloadC 1H 107M 774L 837? 1 rust:1-alpine1,036 MB unpacked · 352 MB download✓ 0 known

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:d841af61827b. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.