EUVD-2026-31654
GHSA-p688-r7jv-fm6f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (rust) · only source for this CVE.
CVSS VectorVendor: rust
Lifecycle Timeline
4DescriptionCVE.org
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is low, due to the extremely niche requirements needed to achieve the attack.
AnalysisAI
Credential leakage in Cargo's sparse index registry URL normalization affects all Cargo releases from 1.68 through 1.96. The flaw caused Cargo to incorrectly apply git-registry canonicalization rules - specifically, stripping .git suffixes and lowercasing GitHub paths - to sparse index protocol URLs (prefixed with sparse+). This allowed two distinct sparse registry URLs that differed only by a .git suffix to resolve to the same canonical identifier, meaning credentials configured for one registry could be transmitted to a different, attacker-controlled registry on the same domain. No public exploit identified at time of analysis; EPSS is 0.04% (12th percentile), consistent with the vendor-assessed low severity and SSVC exploitation status of none.
Technical ContextAI
Cargo implements URL canonicalization in src/cargo/util/canonical_url.rs to produce stable, hashable identifiers for registries. For git-backed registries, stripping .git suffixes is semantically correct because git hosts typically serve the same repository at both repo and repo.git. However, for sparse index registries (identified by the sparse+https:// scheme containing a + character in the scheme), these paths are not git repos but HTTP endpoints where path components are meaningful and distinct. CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions) precisely describes this root cause: authorization/credential scoping decisions were based on a canonicalized URL that incorrectly collapsed two distinct registry identities into one. The fix in PR #17031 gates the .git-stripping and GitHub lowercasing logic on !url.scheme().contains('+'), ensuring sparse registry URLs are not subject to git-specific normalization. CPE: cpe:2.3:a:rust:cargo:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade Cargo to a version beyond 1.96 that incorporates the fix from upstream pull request https://github.com/rust-lang/cargo/pull/17031. The exact first patched release version is not specified in the available advisory data - consult the official Rust release notes at https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ for the confirmed fixed version. As a compensating control for environments that cannot upgrade immediately, organizations can avoid using sparse-protocol registries hosted on multi-tenant providers where arbitrary registry path names within the same domain are permitted; switching to dedicated domain hosting for private registries eliminates the URL collision surface entirely. Credential rotation for any sparse-protocol third-party registry credentials should be considered if the deployment matches the vulnerable hosting topology described in the advisory.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no auth
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contai
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. Rated medium severity (C
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. Rated med
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today