DEBIAN-CVE-2026-5222

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-5222

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-5222

Upstream

CVE-2026-5222

Published

2026-05-25T10:16:15Z

Modified

2026-09-14T17:03:18Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is low, due to the extremely niche requirements needed to achieve the attack.

References

https://security-tracker.debian.org/tracker/CVE-2026-5222

Affected packages

Debian:12

cargo

Package

Name: cargo
Purl: pkg:deb/debian/cargo?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.66.0+ds1-1

0.66.0+ds2-1

0.66.0+ds2-2

0.70.1-1~exp1

0.70.1+ds1-1~exp1

0.70.1+ds1-1

0.70.1+ds1-2

0.70.1+ds1-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"

rust-cargo

Package

Name: rust-cargo
Purl: pkg:deb/debian/rust-cargo?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.66.0-1

0.66.0-2

0.66.0-3

0.66.0-4

0.66.0-5

0.66.0-6

0.70.1-1

0.70.1-2

0.70.1-3

0.76.0-1

0.76.0-2

0.76.0-3

0.76.0-4

0.81.0-1

0.81.0-2

0.81.0-3

0.82.0-1

0.83.0-1

0.83.0-2

0.84.0-1

0.85.0-1

0.86.0-1

0.86.0-2

0.86.0-3

0.86.0-4

0.91.0-1

0.91.0-2

0.91.0-3

0.91.0-4

0.91.0-5

0.96.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"

rustc

Package

Name: rustc
Purl: pkg:deb/debian/rustc?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.63.0+dfsg1-2

1.64.0+dfsg1-1~exp1

1.64.0+dfsg1-1~exp2

1.64.0+dfsg1-1~exp3

1.64.0+dfsg1-1~exp4

1.64.0+dfsg1-1

1.65.0+dfsg1-1~exp1

1.65.0+dfsg1-1~exp2

1.65.0+dfsg1-1~exp3

1.65.0+dfsg1-1

1.65.0+dfsg1-2

1.66.0+dfsg1-1~exp1

1.66.0+dfsg1-1

1.67.1+dfsg1-1~exp1

1.67.1+dfsg1-1

1.68.2+dfsg1-1~exp1

1.68.2+dfsg1-1

1.69.0+dfsg1-1~exp1

1.69.0+dfsg1-1~exp2

1.69.0+dfsg1-1

1.70.0+dfsg1-1~exp1

1.70.0+dfsg1-1~exp2

1.70.0+dfsg1-1~exp3

1.70.0+dfsg1-1

1.70.0+dfsg1-2~exp1

1.70.0+dfsg1-2

1.70.0+dfsg1-3

1.70.0+dfsg1-4

1.70.0+dfsg1-5

1.70.0+dfsg1-6

1.70.0+dfsg1-7

1.70.0+dfsg1-8

1.70.0+dfsg1-8.1

1.70.0+dfsg1-9

1.70.0+dfsg2-1~exp1

1.70.0+dfsg2-1~exp2

1.70.0+dfsg2-1~exp3

1.70.0+dfsg2-1

1.70.0+dfsg2-1+loong64

1.71.1+dfsg1-1~exp1

1.71.1+dfsg1-1~exp2

1.71.1+dfsg1-1

1.71.1+dfsg1-2

1.72.1+dfsg1-1~exp1

1.72.1+dfsg1-1~exp2

1.72.1+dfsg1-1

1.72.1+dfsg1-1+hurd.1

1.73.0+dfsg1-1~exp1

1.73.0+dfsg1-1

1.73.0+dfsg1-1+hurd.1

1.73.0+dfsg1-1+loong64

1.74.1+dfsg1-1~exp1

1.74.1+dfsg1-1

1.74.1+dfsg1-1+hurd.1

1.75.0+dfsg1-1~exp1

1.75.0+dfsg1-1

1.75.0+dfsg1-2

1.75.0+dfsg1-3

1.75.0+dfsg1-4

1.75.0+dfsg1-4+hurd.1

1.75.0+dfsg1-5

1.76.0+dfsg1-1~exp1

1.76.0+dfsg1-1

1.76.0+dfsg1-1+hurd.1

1.77.2+dfsg1-1~exp1

1.77.2+dfsg1-1

1.78.0+dfsg1-1~exp1

1.78.0+dfsg1-2

1.79.0+dfsg1-1~exp1

1.79.0+dfsg1-1

1.79.0+dfsg1-2

1.79.0+dfsg1-2+hurd.1

1.80.0+dfsg1-1~exp1

1.80.1+dfsg1-1~exp1

1.80.1+dfsg1-1

1.80.1+dfsg1-1+hurd.1

1.81.0+dfsg1-1~exp1

1.81.0+dfsg1-1~exp2

1.81.0+dfsg1-1

1.81.0+dfsg1-2

1.82.0+dfsg1-1~exp1

1.82.0+dfsg1-1~exp2

1.82.0+dfsg1-1~exp3

1.82.0+dfsg1-1

1.82.0+dfsg1-2

1.83.0+dfsg1-1~exp1

1.83.0+dfsg1-1

1.84.0+dfsg1-1~exp1

1.84.0+dfsg1-1

1.84.0+dfsg1-2

1.85.0~beta.9+dfsg1-1~exp1

1.85.0+dfsg1-1

1.85.0+dfsg2-1

1.85.0+dfsg2-2

1.85.0+dfsg2-3

1.85.0+dfsg3-1

1.86.0+dfsg1-1~bpo13+1

1.86.0+dfsg1-1~bpo13+2

1.86.0+dfsg1-1~exp1

1.86.0+dfsg1-1~exp2

1.86.0+dfsg1-1~exp2+x32

1.86.0+dfsg1-1~exp3

1.86.0+dfsg1-1~exp4

1.86.0+dfsg1-1

1.87.0+dfsg1-1~bpo13+1

1.87.0+dfsg1-1~bpo13+2

1.87.0+dfsg1-1~exp1

1.87.0+dfsg1-1

1.88.0+dfsg1-1~exp1

1.88.0+dfsg1-1

1.88.0+dfsg1-2~bpo13+1

1.88.0+dfsg1-2

1.89.0+dfsg1-1~bpo13+1

1.89.0+dfsg1-1~bpo13+2

1.89.0+dfsg1-1~exp1

1.89.0+dfsg1-1

1.90.0+dfsg1-1~bpo13+1

1.90.0+dfsg1-1~bpo13+2

1.90.0+dfsg1-1~exp1

1.90.0+dfsg1-1

1.91.1+dfsg1-1~bpo13+1

1.91.1+dfsg1-1~bpo13+2

1.91.1+dfsg1-1~exp1

1.91.1+dfsg1-1~exp2

1.91.1+dfsg1-1~exp3

1.91.1+dfsg1-1

1.92.0+dfsg1-1~exp1

1.92.0+dfsg1-1

1.92.0+dfsg1-2~bpo13+1

1.92.0+dfsg1-2

1.93.1+dfsg1-1~exp1

1.93.1+dfsg1-1

1.93.1+dfsg1-2~bpo13+1

1.93.1+dfsg1-2

1.94.1+dfsg1-1~bpo13+1

1.94.1+dfsg1-1~bpo13+2

1.94.1+dfsg1-1~bpo13+3

1.94.1+dfsg1-1~exp1

1.94.1+dfsg1-1~exp2

1.94.1+dfsg1-1~exp3

1.94.1+dfsg1-1

1.95.0+dfsg1-1

1.95.0+dfsg1-2

1.96.0+dfsg1-1~exp1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"

Debian:13

rust-cargo

Package

Name: rust-cargo
Purl: pkg:deb/debian/rust-cargo?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.86.0-2

0.86.0-3

0.86.0-4

0.91.0-1

0.91.0-2

0.91.0-3

0.91.0-4

0.91.0-5

0.96.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"

rustc

Package

Name: rustc
Purl: pkg:deb/debian/rustc?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.85.1+dfsg1-1+deb13u1

Affected versions

1.*

1.85.0+dfsg3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"

Debian:14

rust-cargo

Package

Name: rust-cargo
Purl: pkg:deb/debian/rust-cargo?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.91.0-3

Affected versions

0.*

0.86.0-2

0.86.0-3

0.86.0-4

0.91.0-1

0.91.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"

rustc

Package

Name: rustc
Purl: pkg:deb/debian/rustc?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.95.0+dfsg1-2

Affected versions

1.*

1.85.0+dfsg3-1

1.86.0+dfsg1-1~bpo13+1

1.86.0+dfsg1-1~bpo13+2

1.86.0+dfsg1-1~exp1

1.86.0+dfsg1-1~exp2

1.86.0+dfsg1-1~exp2+x32

1.86.0+dfsg1-1~exp3

1.86.0+dfsg1-1~exp4

1.86.0+dfsg1-1

1.87.0+dfsg1-1~bpo13+1

1.87.0+dfsg1-1~bpo13+2

1.87.0+dfsg1-1~exp1

1.87.0+dfsg1-1

1.88.0+dfsg1-1~exp1

1.88.0+dfsg1-1

1.88.0+dfsg1-2~bpo13+1

1.88.0+dfsg1-2

1.89.0+dfsg1-1~bpo13+1

1.89.0+dfsg1-1~bpo13+2

1.89.0+dfsg1-1~exp1

1.89.0+dfsg1-1

1.90.0+dfsg1-1~bpo13+1

1.90.0+dfsg1-1~bpo13+2

1.90.0+dfsg1-1~exp1

1.90.0+dfsg1-1

1.91.1+dfsg1-1~bpo13+1

1.91.1+dfsg1-1~bpo13+2

1.91.1+dfsg1-1~exp1

1.91.1+dfsg1-1~exp2

1.91.1+dfsg1-1~exp3

1.91.1+dfsg1-1

1.92.0+dfsg1-1~exp1

1.92.0+dfsg1-1

1.92.0+dfsg1-2~bpo13+1

1.92.0+dfsg1-2

1.93.1+dfsg1-1~exp1

1.93.1+dfsg1-1

1.93.1+dfsg1-2~bpo13+1

1.93.1+dfsg1-2

1.94.1+dfsg1-1~bpo13+1

1.94.1+dfsg1-1~bpo13+2

1.94.1+dfsg1-1~bpo13+3

1.94.1+dfsg1-1~exp1

1.94.1+dfsg1-1~exp2

1.94.1+dfsg1-1~exp3

1.94.1+dfsg1-1

1.95.0+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5222.json"