The developer of curl has done an analysis of what percent of his CVEs would have been avoided in a memory safe language. I think the answer was a bare majority.