Vulnerability HighRUSTSEC-2021-0073 · prost-types
RUSTSEC-2021-0073: Conversion from `prost_types::Timestamp` to `SystemTime` can cause an overflow and panic
Short answerA security vulnerability in the prost-types crate: Conversion from `prost_types::Timestamp` to `SystemTime` can cause an overflow and panic. GitHub rates it High. Fixed in 0.8.0: update to a fixed version.
| Crate | prost-types |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.8.0. |
| Fixed in | 0.8.0 |
| Severity | High (GitHub rating) |
| Published | 2021-07-08 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2021-38192, GHSA-x4qm-mcjq-v2gf |
| Affected functions | prost_types::Timestamp::Into<SystemTime> |
What to do
- See which version you have:
cargo tree -i prost-types(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p prost-types. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleprost-types = "0.8.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime.
It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.
See #438 for more information.
References
- Package: crates.io/crates/prost-types
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0073.html
- Report: github.com/tokio-rs/prost/issues/438
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same crateprost-types: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?