medium6.5
CVE-2026-5222
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.
Impact
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | cargo | < 0.97.0 | 0.97.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rust-Lang | Cargo | from 1.68.0 before 1.96.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-p688-r7jv-fm6f
- https://github.com/rust-lang/cargo/security/advisories/GHSA-p688-r7jv-fm6f
- https://nvd.nist.gov/vuln/detail/CVE-2026-5222
- https://github.com/rust-lang/cargo/pull/17031
- https://blog.rust-lang.org/2026/05/25/cve-2026-5222
- https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s
- https://blog.rust-lang.org/2026/05/25/cve-2026-5222/