CVE-2021-38192
Overflow in prost-types
CVE-2021-38192 is a high vulnerability (CVSS 7.5) in Prost Project Prost, published July 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 66th percentile. Fixed in prost-types 0.8.0.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 1.10%EPSS, 66th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.8.0prost-types +1 more
Description
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prost-typescrates.io | before 0.8.0 | 0.8.0 |
prost-typescrates.io | 0.0.0-0 up to 0.8.0 | 0.8.0 |
What each source reports
NVD Score used
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
- Record
CVE-2021-38192- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
- Record
CVE-2021-38192- Updated
- 2026-11-02
EUVDEUVD-2021-1927No score
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
- Record
EUVD-2021-1927- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4qm-mcjq-v2gf
Overflow in prost-types
Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime. It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.
- Record
GHSA-x4qm-mcjq-v2gf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120, CWE-190
- Updated
- 2026-11-02
OSVGHSA-x4qm-mcjq-v2gf
Overflow in prost-types
Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime. It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.
- Record
GHSA-x4qm-mcjq-v2gf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120, CWE-190
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0073No score
Conversion from `prost_types::Timestamp` to `SystemTime` can cause an overflow and panic
Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime.
It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.
See #438 for more information.
- Record
RUSTSEC-2021-0073- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rustsec.org/advisories/RUSTSEC-2021-0073.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/prost-types/RUSTSEC-2021-0073.md
nvd.nist.gov/vuln/detail/CVE-2021-38192
github.com/tokio-rs/prost/issues/438
crates.io/crates/prost-types