rustup 1.29.2 updates certificate dependencies to address CVE-2026-111943
A small release of the Rust toolchain installer refreshes two TLS-related dependencies in response to an advisory about certain intermediate certificates.
The rustup team released version 1.29.2 on October 20. According to the announcement, it is a small release that only updates the rustls-webpki and webpki-root-certs dependencies, in response to an issue with certain eMudhra intermediate certificates that is tracked as CVE-2026-111943 and RUSTSEC-2026-0382.
Developers can update by closing programs that may be using rustup, such as an IDE, and running rustup self update. Rustup also updates itself at the end of a normal toolchain update, so teams that run rustup update regularly will receive it that way.
The release notes add a general caveat: anti-malware scanners may occasionally block a new rustup release or interfere with file creation while installing rust-docs. The team expects such problems to clear within a few weeks as scanners learn about the release. CI images that pin rustup should consider moving to 1.29.2.
Sources
Verified Oct 22, 2026 (official source). rustrustupsecuritydeveloper-tools