Public bug reported: A full description of this CVE can be found on the rust-lang blog[1].
Cargo incorrectly normalizes the URLs of third-party registries using the sparse index protocol, allowing for credential stealing in very specific circumstances. The severity of this vulnerability is very low due to the extremely niche requirements needed to achieve the attack. [1]: https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ ** Affects: rustc-1.74 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.76 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.77 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.78 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.79 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.80 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.81 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.82 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.84 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.85 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.91 (Ubuntu) Importance: Undecided Status: New ** Affects: rustc-1.92 (Ubuntu) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.93 (Ubuntu) Importance: Undecided Status: New ** Affects: rustc-1.95 (Ubuntu) Importance: Low Status: New ** Affects: rustc-1.76 (Ubuntu Focal) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.77 (Ubuntu Focal) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.78 (Ubuntu Focal) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.79 (Ubuntu Focal) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.80 (Ubuntu Focal) Importance: Undecided Status: New ** Affects: rustc-1.76 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.77 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.78 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.79 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.80 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.81 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.82 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.84 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.85 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.91 (Ubuntu Jammy) Importance: Undecided Status: New ** Affects: rustc-1.74 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.76 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.77 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.78 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.79 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.80 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.81 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.82 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.84 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.85 (Ubuntu Noble) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.91 (Ubuntu Noble) Importance: Undecided Status: New ** Affects: rustc-1.91 (Ubuntu Resolute) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.92 (Ubuntu Resolute) Importance: Undecided Status: Won't Fix ** Affects: rustc-1.93 (Ubuntu Resolute) Importance: Undecided Status: New ** Tags: foundations-todo ** Tags added: foundations-todo ** CVE added: https://cve.org/CVERecord?id=CVE-2026-5222 ** Also affects: rustc-1.93 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.92 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.91 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.85 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.84 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.82 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.81 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.80 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.79 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.78 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.77 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.76 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.74 (Ubuntu) Importance: Undecided Status: New ** Also affects: rustc-1.74 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.76 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.77 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.78 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.79 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.80 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.81 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.82 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.84 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.85 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.91 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.92 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.93 (Ubuntu Stonking) Importance: Undecided Status: New ** Also affects: rustc-1.95 (Ubuntu Stonking) Importance: Low Status: New ** No longer affects: rustc-1.93 (Ubuntu Stonking) ** No longer affects: rustc-1.81 (Ubuntu Stonking) ** No longer affects: rustc-1.82 (Ubuntu Stonking) ** No longer affects: rustc-1.84 (Ubuntu Stonking) ** No longer affects: rustc-1.85 (Ubuntu Stonking) ** No longer affects: rustc-1.91 (Ubuntu Stonking) ** No longer affects: rustc-1.92 (Ubuntu Stonking) ** No longer affects: rustc-1.74 (Ubuntu Stonking) ** No longer affects: rustc-1.76 (Ubuntu Stonking) ** No longer affects: rustc-1.77 (Ubuntu Stonking) ** No longer affects: rustc-1.78 (Ubuntu Stonking) ** No longer affects: rustc-1.79 (Ubuntu Stonking) ** No longer affects: rustc-1.80 (Ubuntu Stonking) ** Also affects: rustc-1.74 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.76 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.77 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.78 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.79 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.80 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.81 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.82 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.84 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.85 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.91 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.92 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.93 (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: rustc-1.95 (Ubuntu Resolute) Importance: Undecided Status: New ** No longer affects: rustc-1.95 (Ubuntu Resolute) ** No longer affects: rustc-1.85 (Ubuntu Resolute) ** No longer affects: rustc-1.84 (Ubuntu Resolute) ** No longer affects: rustc-1.82 (Ubuntu Resolute) ** No longer affects: rustc-1.81 (Ubuntu Resolute) ** No longer affects: rustc-1.80 (Ubuntu Resolute) ** No longer affects: rustc-1.79 (Ubuntu Resolute) ** No longer affects: rustc-1.78 (Ubuntu Resolute) ** No longer affects: rustc-1.77 (Ubuntu Resolute) ** No longer affects: rustc-1.76 (Ubuntu Resolute) ** No longer affects: rustc-1.74 (Ubuntu Resolute) ** Also affects: rustc-1.74 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.76 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.77 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.78 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.79 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.80 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.81 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.82 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.84 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.85 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.91 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.92 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.93 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.95 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: rustc-1.74 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.76 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.77 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.78 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.79 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.80 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.81 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.82 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.84 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.85 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.91 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.92 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.93 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.95 (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: rustc-1.74 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.76 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.77 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.78 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.79 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.80 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.81 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.82 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.84 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.85 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.91 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.92 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.93 (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: rustc-1.95 (Ubuntu Focal) Importance: Undecided Status: New ** No longer affects: rustc-1.95 (Ubuntu Jammy) ** No longer affects: rustc-1.95 (Ubuntu Noble) ** No longer affects: rustc-1.93 (Ubuntu Noble) ** No longer affects: rustc-1.92 (Ubuntu Jammy) ** No longer affects: rustc-1.93 (Ubuntu Jammy) ** No longer affects: rustc-1.92 (Ubuntu Noble) ** No longer affects: rustc-1.74 (Ubuntu Jammy) ** No longer affects: rustc-1.74 (Ubuntu Focal) ** No longer affects: rustc-1.81 (Ubuntu Focal) ** No longer affects: rustc-1.82 (Ubuntu Focal) ** No longer affects: rustc-1.84 (Ubuntu Focal) ** No longer affects: rustc-1.85 (Ubuntu Focal) ** No longer affects: rustc-1.91 (Ubuntu Focal) ** No longer affects: rustc-1.92 (Ubuntu Focal) ** No longer affects: rustc-1.93 (Ubuntu Focal) ** No longer affects: rustc-1.95 (Ubuntu Focal) ** Changed in: rustc-1.92 (Ubuntu Resolute) Status: New => Won't Fix ** Changed in: rustc-1.92 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.91 (Ubuntu Resolute) Status: New => Won't Fix ** No longer affects: rustc-1.95 (Ubuntu Stonking) ** Changed in: rustc-1.85 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.85 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.85 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.84 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.84 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.84 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.82 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.82 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.82 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.81 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.81 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.81 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.80 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.80 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.80 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.79 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.79 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.79 (Ubuntu Focal) Status: New => Won't Fix ** Changed in: rustc-1.79 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.78 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.78 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.78 (Ubuntu Focal) Status: New => Won't Fix ** Changed in: rustc-1.78 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.77 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.77 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.77 (Ubuntu Focal) Status: New => Won't Fix ** Changed in: rustc-1.77 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.76 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.76 (Ubuntu Jammy) Status: New => Won't Fix ** Changed in: rustc-1.76 (Ubuntu Focal) Status: New => Won't Fix ** Changed in: rustc-1.76 (Ubuntu) Status: New => Won't Fix ** Changed in: rustc-1.74 (Ubuntu Noble) Status: New => Won't Fix ** Changed in: rustc-1.74 (Ubuntu) Status: New => Won't Fix -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2165793 Title: CVE-2026-5222: Incorrect Cargo URL normalization To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rustc-1.74/+bug/2165793/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
