Unmaintained CriticalRUSTSEC-2020-0036 · failure
RUSTSEC-2020-0036: failure is officially deprecated/unmaintained
Short answerNot a bug report: failure is no longer maintained, so future security issues will not be fixed. Plan to move to a maintained alternative.
| Crate | failure |
|---|---|
| Type | Unmaintained |
| Affected versions | Every version. |
| Fixed in | not applicable (the crate is unmaintained) |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-05-02 |
| Last changed | 2024-02-10 |
| Also known as | CVE-2019-25010, CVE-2020-25575, GHSA-jq66-xh47-j9f3, GHSA-r98r-j25q-rmpr, RUSTSEC-2019-0036 |
What to do
- Look for a maintained fork or alternative crate.
- If you cannot move yet, acknowledge it in your audit config so CI stays green while you plan: add
"RUSTSEC-2020-0036"toignorein.cargo/audit.tomlordeny.toml, with a comment saying why. - Find who pulls it in:
cargo tree -i failure.
Details from the advisory
The failure crate is officially end-of-life: it has been marked as deprecated by the former maintainer, who has announced that there will be no updates or maintenance work on it going forward.
The following are some suggested actively developed alternatives to switch to:
References
- Package: crates.io/crates/failure
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0036.html
- Web: github.com/rust-lang-nursery/failure/pull/347
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for failure
Up next
Same cratefailure: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?