Unsound CriticalRUSTSEC-2019-0036 · failure
RUSTSEC-2019-0036: Type confusion if __private_get_type_id__ is overridden
Short answerfailure has an API that can cause undefined behaviour from safe code: Type confusion if __private_get_type_id__ is overridden. No fixed version yet.
| Crate | failure |
|---|---|
| Type | Unsound |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2019-11-13 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2019-25010, CVE-2020-25575, GHSA-jq66-xh47-j9f3, GHSA-r98r-j25q-rmpr, RUSTSEC-2020-0036 |
| Affected functions | failure::Fail::__private_get_type_id__ |
What to do
- Find who pulls it in:
cargo tree -i failure. - Avoid the affected API (
failure::Fail::__private_get_type_id__), or replace the crate.
Details from the advisory
Safe Rust code can implement malfunctioning __private_get_type_id__ and cause type confusion when downcasting, which is an undefined behavior.
Users who derive Fail trait are not affected.
References
- Package: crates.io/crates/failure
- Advisory: rustsec.org/advisories/RUSTSEC-2019-0036.html
- Report: github.com/rust-lang-nursery/failure/issues/336
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for failure
Up next
Same cratefailure: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?