{"id":"CVE-2019-25010","aliases":["DEBIAN-CVE-2019-25010","EUVD-2021-1863","GHSA-jq66-xh47-j9f3","GHSA-r98r-j25q-rmpr","RUSTSEC-2019-0036","RUSTSEC-2020-0036","UBUNTU-CVE-2019-25010"],"status":"published","title":"Rust Failure Crate Vulnerable to Type confusion","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01535,"percentile":0.75,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-843"],"published":"2019-11-13T12:00:00Z","modified":"2026-10-20T10:52:53Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"failure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-failure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.7-1"]},{"source":"osv","ecosystem":"crates.io","package":"failure","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.1.8"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"failure","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.1.8"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"failure","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"failure","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-failure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-failure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-failure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.7-1"]}],"products":[{"vendor":"failure_project","product":"failure"}],"references":[{"url":"https://github.com/rust-lang-nursery/failure/issues/336","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2019-0036.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r98r-j25q-rmpr"},{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0036.html","tags":["advisory","web"]},{"url":"https://boats.gitlab.io/blog/post/failure-to-fehler/","tags":["evidence"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-25010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25575","tags":["advisory"]},{"url":"https://github.com/RustCrypto/hashes/pull/91","tags":["web"]},{"url":"https://boats.gitlab.io/blog/post/failure-to-fehler","tags":["web"]},{"url":"https://github.com/RustSec/advisory-db/blob/main/crates/failure/RUSTSEC-2019-0036.md","tags":["web"]},{"url":"https://github.com/rust-lang-nursery/failure","tags":["package"]},{"url":"https://crates.io/crates/failure","tags":["package"]},{"url":"https://github.com/rust-lang-nursery/failure/pull/347","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-25010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25010","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-25010","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","status":"published","published":"2020-12-31T08:31:16Z","modified":"2024-08-05T03:00:19.018Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2021-1863","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","status":"published","published":"2020-12-31T08:31:16Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-r98r-j25q-rmpr","title":"Rust Failure Crate Vulnerable to Type confusion","description":"Safe Rust code can implement malfunctioning `__private_get_type_id__` and cause type confusion when downcasting, which is an undefined behavior.\n\nUsers who derive Fail trait are not affected.","status":"published","published":"2021-08-25T20:46:38Z","modified":"2023-11-09T05:01:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:37:17.64478Z"}],"nvd":[{"id":"CVE-2019-25010","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","status":"published","published":"2020-12-31T10:15:14.69Z","modified":"2026-06-17T02:31:28.397Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-25010","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","status":"published","published":"2020-12-31T10:15:14.69Z","modified":"2026-10-20T10:52:41.736143537Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"CVE-2020-25575","description":"An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce \"compatibility hazards\" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010","status":"published","published":"2020-09-14T19:15:11.397Z","modified":"2026-10-20T10:52:53.252781682Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2019-25010","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","status":"published","published":"2020-12-31T10:15:14.69Z","modified":"2026-09-21T07:03:18.340381974Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-jq66-xh47-j9f3","title":"Type confusion if __private_get_type_id__ is overriden","description":"An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce \"compatibility hazards\" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010.","status":"published","published":"2022-06-16T23:06:58Z","modified":"2024-07-03T21:13:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"GHSA-r98r-j25q-rmpr","title":"Rust Failure Crate Vulnerable to Type confusion","description":"Safe Rust code can implement malfunctioning `__private_get_type_id__` and cause type confusion when downcasting, which is an undefined behavior.\n\nUsers who derive Fail trait are not affected.","status":"published","published":"2021-08-25T20:46:38Z","modified":"2023-11-08T04:01:32.420171Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RUSTSEC-2019-0036","title":"Type confusion if __private_get_type_id__ is overridden","description":"Safe Rust code can implement malfunctioning `__private_get_type_id__` and cause\ntype confusion when downcasting, which is an undefined behavior.\n\nUsers who derive `Fail` trait are not affected.","status":"published","published":"2019-11-13T12:00:00Z","modified":"2023-11-08T04:01:32.420171Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"RUSTSEC-2020-0036","title":"failure is officially deprecated/unmaintained","description":"The `failure` crate is officially end-of-life: it has been marked as deprecated\nby the former maintainer, who has announced that there will be no updates or\nmaintenance work on it going forward.\n\nThe following are some suggested actively developed alternatives to switch to:\n\n- [`anyhow`](https://crates.io/crates/anyhow)\n- [`eyre`](https://crates.io/crates/eyre)\n- [`fehler`](https://crates.io/crates/fehler)\n- [`snafu`](https://crates.io/crates/snafu)\n- [`thiserror`](https://crates.io/crates/thiserror)","status":"published","published":"2020-05-02T12:00:00Z","modified":"2024-02-10T15:57:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2019-25010","description":"An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.","status":"published","published":"2020-12-31T10:15:00Z","modified":"2025-10-24T04:48:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"}]}}