rustup 1.29.2 updates its certificate libraries to address a CVE

The small rustup release bumps two TLS-related dependencies and can be installed with rustup self update.

The Rust project has released rustup 1.29.2, the tool most developers use to install and manage Rust toolchains. The release is small: it only updates the rustls-webpki and webpki-root-certs dependencies.

The update addresses a certificate issue involving intermediate certificates from eMudhra, which the team tracks as CVE-2026-111943 and RUSTSEC-2026-0382. Further detail is in the rustup changelog.

Developers with rustup installed can update by closing programs that may be using it, such as an IDE, and running rustup self update. Rustup also updates itself at the end of a normal rustup update run.

The team notes that anti-malware scanners may briefly block a new rustup release, particularly while rust-docs is installed. They expect such problems to clear within a few weeks as scanners learn the new version.

Sources

• Announcing rustup 1.29.2official

Verified Oct 24, 2026 (official source). rustrustupsecuritydeveloper-tools