CVE-2018-20989
Integer underflow in untrusted
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
- Record
CVE-2018-20989- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-191
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
- Record
CVE-2018-20989- Updated
- 2026-11-02
EUVDEUVD-2021-1919 No score
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
- Record
EUVD-2021-1919- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wq8f-46ww-6c2h
Integer underflow in untrusted
A mistake in error handling in untrusted before 0.6.2 could lead to an integer underflow and panic if a user of the crate didn't properly check for errors returned by untrusted. Combination of these two programming errors (one in untrusted and another by user of this crate) could lead to a panic and maybe a denial of service of affected software. The error in untrusted is fixed in release 0.6.2 released 2018-06-21. It's also advisable that users of untrusted check for their sources for cases where errors returned by untrusted are not handled correctly.
- Record
GHSA-wq8f-46ww-6c2h- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSVGHSA-wq8f-46ww-6c2h
Integer underflow in untrusted
A mistake in error handling in untrusted before 0.6.2 could lead to an integer underflow and panic if a user of the crate didn't properly check for errors returned by untrusted. Combination of these two programming errors (one in untrusted and another by user of this crate) could lead to a panic and maybe a denial of service of affected software. The error in untrusted is fixed in release 0.6.2 released 2018-06-21. It's also advisable that users of untrusted check for their sources for cases where errors returned by untrusted are not handled correctly.
- Record
GHSA-wq8f-46ww-6c2h- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSVRUSTSEC-2018-0001
An integer underflow could lead to panic
A mistake in error handling in untrusted before 0.6.2 could lead to an integer underflow and panic if a user of the crate didn't properly check for errors returned by untrusted.
Combination of these two programming errors (one in untrusted and another by user of this crate) could lead to a panic and maybe a denial of service of affected software.
The error in untrusted is fixed in release 0.6.2 released 2018-06-21. It's also advisable that users of untrusted check for their sources for cases where errors returned by untrusted are not handled correctly.
- Record
RUSTSEC-2018-0001- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-20989
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
- Record
UBUNTU-CVE-2018-20989- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
untrustedcrates.io |
before 0.6.2 | 0.6.2 |
untrustedcrates.io |
0.0.0-0 up to 0.6.2 | 0.6.2 |
rust-untrustedUbuntu:20.04:LTS |
All versions, plus listed versions 0.7.0-1 |
None known |
rust-untrustedUbuntu:22.04:LTS |
All versions, plus listed versions 0.7.0-1 |
None known |
rust-untrustedUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.1-10.9.0-2 |
None known |
rust-untrustedUbuntu:25.10 |
All versions, plus listed versions 0.9.0-2 |
None known |
rust-untrustedUbuntu:26.10 |
All versions, plus listed versions 0.9.0-2 |
None known |
rust-untrustedUbuntu:26.04:LTS |
All versions, plus listed versions 0.9.0-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20989 is a high vulnerability (CVSS 7.5) in Untrusted Project Untrusted, published June 21, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in untrusted 0.6.2.