← Vulnerability feed

Vulnerability record · CVE-2019-16760 · published 30 September 2019

CVE-2019-16760: Rust-lang rust download of code without integrity check vulnerability

Rust Lang · Rust

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.

7.5 CVSS 3.1 High EPSS 1.3% · top 31.6% CWE-16 · CWE-16CWE-494 · Download of code without integrity check
7.5CVSS 3.1 base score, v2 5.0
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2019/10/08/3
https://gist.github.com/pietroalbini/0d293b24a44babbeb6187e06eebd4992 PatchThird Party Advisory
https://github.com/rust-lang/rust/security/advisories/GHSA-phjm-8x66-qw4r ExploitThird Party Advisory
https://groups.google.com/forum/#%21topic/rustlang-security-announcements/rVQ5e3TDnpQ
http://www.openwall.com/lists/oss-security/2019/10/08/3
https://gist.github.com/pietroalbini/0d293b24a44babbeb6187e06eebd4992 PatchThird Party Advisory
https://github.com/rust-lang/rust/security/advisories/GHSA-phjm-8x66-qw4r ExploitThird Party Advisory
https://groups.google.com/forum/#%21topic/rustlang-security-announcements/rVQ5e3TDnpQ

Track CVE-2019-16760 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-24576Fedoraproject fedora os command injection vulnerabilityRust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly es…EPSS 20%9.8CVE-2024-3566Haskell process library command injection vulnerabilityA command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu…EPSS 6.9%9.8CVE-2021-31162Rust-lang rust double free vulnerabilityIn the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.EPSS 2.9%9.8CVE-2020-36318Rust-lang rust double free vulnerabilityIn the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition.…EPSS 1.7%9.8CVE-2021-28879Rust-lang rust integer overflow vulnerabilityIn the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a…EPSS 2.4%9.8CVE-2018-1000810Rust-lang rust integer overflow vulnerabilityThe Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflo…EPSS 3.0%9.1CVE-2021-29922Rust-lang rust vulnerabilitylibrary/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, w…EPSS 2.6%8.8CVE-2024-43402Rust-lang rust os command injection vulnerabilityRust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on …EPSS 0.74%

Source: NIST National Vulnerability Database (record CVE-2019-16760), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.