Improper Input Validation in personnummer/rust
Summary
GHSA-28r9-pq4c-wp3c: personnummer/rust vulnerable to Improper Input Validation. Affects personnummer versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
personnummer/rust is a package available on crates.io that provides functionality for working with Swedish personal identification numbers (personnummer). It allows users to validate and manipulate personnummer strings. However, a vulnerability has been discovered in the package that affects the validation of the last four digits of the personnummer.
Vulnerability Detail
The vulnerability in personnummer/rust is due to improper input validation. The regular expression used for validation allows the first three digits in the last four digits of the personnummer to be '000', which is invalid. This means that personnummer strings with '000' as the first three digits in the last four digits will be considered valid, leading to potential misinterpretation of the data. This vulnerability has a low severity rating but can impact users who rely on the last digits of personnummer to be a real personnummer.
How To Fix
Latest published version: 3.1.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the personnummer/rust package immediately, you can implement a workaround by checking the last four digits of the personnummer to ensure they are not '000x'. This can be done by adding a validation step in your code. Here's an example in Rust:
fn is_valid_personnummer(personnummer: &str) -> bool {
let last_four_digits = &personnummer[personnummer.len() - 4..];
if last_four_digits == "000x" {
return false;
}
// Rest of the validation logic
true
}
Conclusion
The vulnerability in personnummer/rust allows personnummer strings with '000' as the first three digits in the last four digits to be considered valid, potentially leading to misinterpretation of the data. It is recommended to update the personnummer/rust package to version 3.0.0 or later to fix this vulnerability. If you are unable to update immediately, you can implement a workaround by checking the last four digits of the personnummer. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for personnummer →
FAQ
personnummer/rust is a package available on crates.io that provides functionality for working with Swedish personal identification numbers (personnummer). It allows users to validate and manipulate personnummer strings.
The vulnerability allows personnummer strings with '000' as the first three digits in the last four digits to be considered valid, potentially leading to misinterpretation of the data. However, the severity of this vulnerability is low.
To fix the vulnerability, you should update your personnummer/rust package to version 3.0.0 or later. Refer to the package documentation or the provided patch links for more information on how to update.
If you are unable to update the personnummer/rust package immediately, you can implement a workaround by checking the last four digits of the personnummer to ensure they are not '000x'. Refer to the provided workaround section for code examples.
For more information about this vulnerability, you can open an issue in the Personnummer Meta repository or email the Personnummer team at security@personnummer.dev.
References
Related vulnerabilities
Recent vulnerabilities recorded for personnummer.
