RUSTSEC-2020-0166: personnummer Input validation error

What to do

1. See which version you have: cargo tree -i personnummer (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p personnummer. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example personnummer = "3.0.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Swedish personal identity is in the form of YYMMDD-XXXX

An issue arises from the regular expression allowing the first three digits in the last four digits of the personnummer to be 000, which is invalid.

To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not 000x.

The affected version should not be relied on without the mitigation to check that the swedish personal identity number is valid.

References

• Package: crates.io/crates/personnummer
• Advisory: rustsec.org/advisories/RUSTSEC-2020-0166.html
• Web: github.com/personnummer/rust/pull/4

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.