Vulnerability HighRUSTSEC-2025-0040 · users
RUSTSEC-2025-0040: `root` appended to group listings
Short answerA security vulnerability in the users crate: `root` appended to group listings. GitHub rates it High. No fixed version: replace the crate or remove the affected code path.
| Crate | users |
|---|---|
| Type | Vulnerability (privilege-escalation) |
| Affected versions | From 0.8.0 onward (every version). |
| Fixed in | none |
| Severity | High (GitHub rating) |
| Published | 2025-01-15 |
| Last changed | 2025-10-28 |
| Also known as | CVE-2025-5791, GHSA-m65q-v92h-cm7q |
What to do
- Find who pulls it in:
cargo tree -i users. - Avoid the affected API, or replace the crate.
Details from the advisory
Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.
This affects both:
- The supplementary groups of a user
- The group access list of the current process
If the caller uses this information for access control, this may lead to privilege escalation.
This crate is not currently maintained, so a patched version is not available.
Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.
Recommended alternatives
References
- Package: crates.io/crates/users
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0040.html
- Report: github.com/ogham/rust-users/issues/44
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for users
Up next
Same crateusers: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?