high7.1
CVE-2025-5791
users may append `root` to group listings
Impact
Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege escalation. This crate is not currently maintained, so a patched version is not available. Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround. ## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | users | >= 0.8.0, <= 0.11.0 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2025:12359
- https://access.redhat.com/security/cve/CVE-2025-5791
- https://bugzilla.redhat.com/show_bug.cgi?id=2370001
- https://crates.io/crates/users
- https://github.com/ogham/rust-users/issues/44
- https://rustsec.org/advisories/RUSTSEC-2025-0040.html
- https://github.com/advisories/GHSA-m65q-v92h-cm7q
- https://nvd.nist.gov/vuln/detail/CVE-2025-5791