polycvss v0.2.0

I just released polycvss version 0.2.0.

polycvss is a Rust library to parse and score CVSS vector strings.

Features:

• CVSS v2, CVSS v3, and CVSS v4 support.
• Version-agnostic parsing and scoring API.
• Memory efficient: Vectors are 8 bytes. Scores and severities are 1 byte.
• No dependencies by default except the standard library.
• Optional serde integration via the serde build feature.
• Extensive tests: Tested against thousands of vectors and scores from the NVD CVSS calculators.

Here is an example tool which parses the first command-line argument as a CVSS vector string, then prints the score and severity:

use polycvss::{Err, Score, Severity, Vector};

fn main() -> Result<(), Err> {
  let args: Vec<String> = std::env::args().collect(); // get cli args

  if args.len() == 2 {
    let vec: Vector = args[1].parse()?; // parse string
    let score = Score::from(vec); // get score
    let severity = Severity::from(score); // get severity
    println!("{score} {severity}"); // print score and severity
  } else {
    let name = args.first().map_or("app", |s| s); // get app name
    eprintln!("Usage: {name} [VECTOR]"); // print usage
  }

  Ok(())
}

Here is the example tool output for a CVSS v2 vector string, a CVSS v3 vector string, and a CVSS v4 vector string:

# test with cvss v2 vector string
$ cvss-score "AV:A/AC:H/Au:N/C:C/I:C/A:C"
6.8 MEDIUM

# test with cvss v3 vector string
$ cvss-score "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
9.8 CRITICAL

# test with cvss v4 vector string
$ cvss-score "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H"
5.2 MEDIUM

This example tool is included in the Git repository as src/bin/cvss-score.rs.

Links

• polycvss Git repository
• polycvss package on crates.io
• polycvss API Documentation on docs.rs

Updates

• 2025-10-12: polycvss v0.2.1: Add polycvss::v4::Nomenclature and improve documentation.
• 2025-10-18: polycvss v0.3.0: Add user-friendly Error messages, remove unreleased CVSS v2.x Version variants, and improve documentation.
• 2025-10-19: polycvss v0.3.1: Documentation improvements.
• 2025-11-16: polycvss v0.3.2: Add impl From<Vector> for Severity and examples/ directory.
• 2026-02-01: polycvss v0.3.3: Add v4-scores example, update dependencies, documentation and formatting fixes.
• 2026-03-07: polycvss v0.3.4: Update dependencies and copyright year. Minor documentation improvements.
• 2026-03-27: polycvss v0.3.5: Increase test coverage to 98%. Add impl std::error::Error for polycvss::Err. Remove unused code. Minor documentation fixes and improvements.
• 2026-06-28: polycvss v0.4.0: Increase test coverage to 99%. Derive Hash for many types. Add Err::InvalidChar and check for invalid characters when parsing vector strings. Add fuzz targets. Documentation fixes and improvements.