CVE-2026-5222

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-5222
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ Vendor Advisory
https://github.com/rust-lang/cargo/pull/17031 Issue Tracking Patch
https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*
History

23 Jul 2026, 17:10

Type Values Removed Values Added
Summary
  • (es) Cargo entre 1.68 y 1.96 normalizó incorrectamente las URL de registros de terceros utilizando el protocolo de índice disperso. Si un proveedor de alojamiento permitía que se alojaran múltiples registros con nombres arbitrarios dentro del mismo dominio, un atacante capaz de publicar crates en un registro podría obtener las credenciales de otros usuarios del mismo registro. La gravedad de la vulnerabilidad es baja, debido a los requisitos extremadamente específicos necesarios para lograr el ataque.

17 Jun 2026, 10:58

Type Values Removed Values Added
References () https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s - Third Party Advisory, Mailing List () https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s - Mailing List, Third Party Advisory

01 Jun 2026, 17:56

Type Values Removed Values Added
References () https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ - () https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ - Vendor Advisory
References () https://github.com/rust-lang/cargo/pull/17031 - () https://github.com/rust-lang/cargo/pull/17031 - Issue Tracking, Patch
References () https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s - () https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s - Third Party Advisory, Mailing List
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*
First Time Rust-lang
Rust-lang cargo

25 May 2026, 10:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-25 10:16

Updated : 2026-07-23 17:10

NVD link : CVE-2026-5222

Mitre link : CVE-2026-5222

CVE.ORG link : CVE-2026-5222

JSON object : View

Products Affected

rust-lang

  • cargo
CWE
CWE-647

Use of Non-Canonical URL Paths for Authorization Decisions