A Rust -sys crate is a package that declares it links to a native library, usually C, through the links key in its manifest and a build script. Rust advisories describe the crate. A bug in the underlying C library may be tracked somewhere else, so check both.
The convention, from the Cargo reference
The Cargo build script documentation describes the links manifest key as a way to declare that a package links with a given native library. A package with a links key must have a build script, which should use the rustc-link-lib instruction to link the library.
Cargo allows at most one package per links value, which stops two crates from linking the same native library and creating duplicate symbols. The reference also says a package named foo-sys should provide two things: it links to the native library, and it exposes a low level interface to it. Many have a companion crate without the suffix that offers a safe Rust API.
Why this is a security topic
When a crate wraps a C library, the code that runs lives in two places. The Rust crate is checked by Rust advisories and tools. The C library has its own version, its own bug history and its own distribution channel.
Three cases look different:
| Case | Where the C code comes from | Who patches it |
|---|---|---|
| Links to a system library | The operating system | OS updates |
| Builds a bundled copy | Source vendored inside the crate | A new crate release |
| Optional vendored feature | Your choice at build time | You, by feature and version |
Which case applies is decided by the crate's build script and features, so read its documentation. We cover feature choices in default features false and attack surface.
What to check in your own project
- List crates whose name ends in -sys. The tree command from cargo tree invert helps see who pulls them in.
- For each, find out whether you link a system copy or a bundled one.
- If bundled, record the C library version the crate carries. It is often visible in the crate's own documentation or source.
- Track that C library's security announcements, not only RustSec.
- Rebuild and redeploy when a fixed crate release appears, since a bundled copy is compiled in.
Why advisories can diverge
A C library fix may arrive upstream before the Rust crate bundles it, or the other way round. Your scanner needs to connect the Rust package to the C library, which many do not. The broader pattern is in bundled native code in language packages.
Where Safeguard fits
Safeguard's dependency scanning and SBOM generation cover Cargo projects, and the free scan at gold.safeguard.sh/scan is a quick way to see your Rust inventory.
Quick check
Does the links key require a build script?
Yes. The Cargo reference says a package with a links key must have a build script.
Does cargo audit cover a bundled C library?
Only if an advisory exists for the crate. Check the C library's own announcements as well.
Sources
Last reviewed: 19 October 2026.
