CVE catalog
CVE-2026-5222
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary nam
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.48% · Oct 25, 2026
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cargo | bookworm | 0.66.0+ds1-1 | vulnerable |
| Debian | rustc | sid | 1.97.1+dfsg1-1 | fixed |
| Debian | rustc | forky | 1.97.1+dfsg1-1 | fixed |
| Debian | rustc | trixie | 1.85.1+dfsg1-1+deb13u1 | fixed |
| Debian | rustc | bookworm | 1.63.0+dfsg1-2 | vulnerable |
| Debian | rust-cargo | sid | 0.99.0-1 | fixed |
| Debian | rust-cargo | forky | 0.99.0-1 | fixed |
| Debian | rust-cargo | trixie | 0.86.0-2 | vulnerable |
| Debian | rust-cargo | bookworm | 0.66.0-1 | vulnerable |
| Cpe | cargo | Not reported | Not reported | vulnerable |
| Cpe | rust-cargo | Not reported | Not reported | vulnerable |
| Cpe | rustc | Not reported | Not reported | vulnerable |
| Cpe | cargo | Not reported | 1.96.0 | fixed |
| Alpine | rust | 3.23 | 1.91.1-r2 | fixed |
| Alpine | rust | 3.24 | 1.96.0-r0 | fixed |
| Ubuntu | rustc | pro | 1.37.0+dfsg1+llvm-1ubuntu1 | vulnerable |
| Ubuntu | rustc | pro | 1.38.0+dfsg0.2+llvm-0ubuntu1 | vulnerable |
| Ubuntu | rustc | pro | 1.38.0+dfsg0.2+llvm-0ubuntu2 | vulnerable |
| Ubuntu | rustc | pro | 1.39.0+dfsg1+llvm-3ubuntu1 | vulnerable |
| Ubuntu | rustc | pro | 1.40.0+dfsg1+llvm-5ubuntu1 | vulnerable |
| Ubuntu | rustc | pro | 1.41.0+dfsg1+llvm-0ubuntu1 | vulnerable |
| Ubuntu | rustc | pro | 1.41.0+dfsg1+llvm-0ubuntu2 | vulnerable |
| Ubuntu | rustc | pro | 1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.47.0+dfsg1+llvm-1ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2 | vulnerable |
| Ubuntu | rustc | pro | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.57.0+dfsg1+llvm-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2 | vulnerable |
| Ubuntu | rustc | pro | 1.61.0+dfsg1~llvm-1~exp1ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc | pro | 1.66.1+dfsg0ubuntu1~llvm-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc | pro | 1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc | pro | 1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc | pro | 1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc | pro | 1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc | pro | 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | cargo | pro | 0.52.0-0ubuntu1 | vulnerable |
| Ubuntu | cargo | pro | 0.53.0-0ubuntu2 | vulnerable |
| Ubuntu | cargo | pro | 0.54.0-0ubuntu1 | vulnerable |
| Ubuntu | cargo | pro | 0.54.0-0ubuntu2 | vulnerable |
| Ubuntu | cargo | pro | 0.57.0+ubuntu-0ubuntu1 | vulnerable |
| Ubuntu | cargo | pro | 0.58.0-0ubuntu1 | vulnerable |
| Ubuntu | cargo | pro | 0.60.0ubuntu1-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cargo | pro | 0.62.0ubuntu0libgit2-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | cargo | pro | 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.22.04 | vulnerable |
| Ubuntu | cargo | pro | 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | cargo | pro | 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1 | vulnerable |
| Ubuntu | rustc-1.76 | pro | 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc-1.76 | pro | 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc-1.77 | pro | 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc-1.77 | pro | 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc-1.78 | pro | 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc-1.78 | pro | 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc-1.79 | pro | 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc-1.79 | pro | 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3 | vulnerable |
| Ubuntu | rustc-1.80 | pro | 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04 | vulnerable |
| Ubuntu | rustc-1.80 | pro | 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.51.0+dfsg1+llvm-1~exp3ubuntu1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.53.0+dfsg1+llvm-4ubuntu1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.54.0+dfsg2+llvm-3ubuntu1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.56.0+dfsg1+llvm-2ubuntu1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.56.0+dfsg1+llvm-2ubuntu2 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.57.0+dfsg1+llvm-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.57.0+dfsg1+llvm-0ubuntu2 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.58.1+dfsg1~ubuntu1-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.58.1+dfsg1~ubuntu1-0ubuntu2 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.59.0+dfsg1-1~ubuntu2~22.04.1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.61.0+dfsg1-1~exp1ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.65.0+dfsg0ubuntu1-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.66.1+dfsg0ubuntu1-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc | 22.04 | 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.62 | 22.04 | 1.62.1+dfsg1-1ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.62 | 22.04 | 1.62.1+dfsg1-1ubuntu0.22.04.3 | vulnerable |
| Ubuntu | rustc-1.76 | 22.04 | 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.76 | 22.04 | 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.77 | 22.04 | 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.77 | 22.04 | 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.78 | 22.04 | 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.78 | 22.04 | 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.79 | 22.04 | 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.79 | 22.04 | 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.80 | 22.04 | 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.80 | 22.04 | 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.81 | 22.04 | 1.81.0+dfsg0ubuntu0-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.81 | 22.04 | 1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.82 | 22.04 | 1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04 | vulnerable |
| Ubuntu | rustc-1.82 | 22.04 | 1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.83 | 22.04 | 1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04~ppa3 | vulnerable |
| Ubuntu | rustc-1.83 | 22.04 | 1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1 | vulnerable |
| Ubuntu | rustc-1.84 | 22.04 | 1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04 | vulnerable |
| Ubuntu | rustc-1.84 | 22.04 | 1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1 | vulnerable |
| Ubuntu | rustc-1.85 | 22.04 | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.22.03 | vulnerable |
| Ubuntu | rustc-1.85 | 22.04 | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04 | vulnerable |
| Ubuntu | rustc-1.85 | 22.04 | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1 | vulnerable |
| Ubuntu | rustc-1.89 | 22.04 | 1.89.0+dfsg~24.04-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rustc-1.89 | 22.04 | 1.89.0+dfsg~24.04-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | rustc-1.91 | 22.04 | 1.91.1+dfsg~22.04-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | rustc-1.91 | 22.04 | 1.91.1+dfsg~22.04-0ubuntu0.22.04.3 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.71.1+dfsg0ubuntu2-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.73.0+dfsg0ubuntu1-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.74.1+dfsg0ubuntu1-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.75.0+dfsg0ubuntu1-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.75.0+dfsg0ubuntu1-0ubuntu6 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.75.0+dfsg0ubuntu1-0ubuntu7 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.75.0+dfsg0ubuntu1-0ubuntu7.1 | vulnerable |
| Ubuntu | rustc | 24.04 | 1.75.0+dfsg0ubuntu1-0ubuntu7.4 | vulnerable |
| Ubuntu | rustc-1.74 | 24.04 | 1.74.1+dfsg0ubuntu1-0ubuntu2 | vulnerable |
| Ubuntu | rustc-1.74 | 24.04 | 1.74.1+dfsg0ubuntu1-0ubuntu13 | vulnerable |
| Ubuntu | rustc-1.74 | 24.04 | 1.74.1+dfsg0ubuntu1-0ubuntu15 | vulnerable |
| Ubuntu | rustc-1.76 | 24.04 | 1.76.0+dfsg0ubuntu1-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.76 | 24.04 | 1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | rustc-1.77 | 24.04 | 1.77.2+dfsg1ubuntu1-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.77 | 24.04 | 1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.78 | 24.04 | 1.78.0+dfsg1ubuntu1-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.78 | 24.04 | 1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | rustc-1.79 | 24.04 | 1.79.0+dfsg1ubuntu1-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.79 | 24.04 | 1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.80 | 24.04 | 1.80.1+dfsg0ubuntu1-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.80 | 24.04 | 1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01 | vulnerable |
| Ubuntu | rustc-1.81 | 24.04 | 1.81.0+dfsg0ubuntu1-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.81 | 24.04 | 1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.82 | 24.04 | 1.82.0+dfsg0ubuntu0-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.82 | 24.04 | 1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.83 | 24.04 | 1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.83 | 24.04 | 1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.84 | 24.04 | 1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04 | vulnerable |
| Ubuntu | rustc-1.84 | 24.04 | 1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1 | vulnerable |
| Ubuntu | rustc-1.85 | 24.04 | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04 | vulnerable |
| Ubuntu | rustc-1.85 | 24.04 | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | rustc-1.89 | 24.04 | 1.89.0+dfsg~24.04-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.89 | 24.04 | 1.89.0+dfsg~24.04-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | rustc-1.91 | 24.04 | 1.91.1+dfsg~24.04-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | rustc-1.91 | 24.04 | 1.91.1+dfsg~24.04-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | rustc-1.91 | 24.04 | 1.91.1+dfsg~24.04-0ubuntu0.24.04.3 | vulnerable |
| Ubuntu | rustc-1.85 | 25.10 | 1.85.1+dfsg0ubuntu1-0ubuntu1 | vulnerable |
| Ubuntu | rustc-1.85 | 25.10 | 1.85.1+dfsg0ubuntu2-0ubuntu1 | vulnerable |
| Ubuntu | rustc-1.85 | 25.10 | 1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1 | vulnerable |
| Ubuntu | rustc-1.88 | 25.10 | 1.88.0+dfsg0ubuntu1-0ubuntu1 | vulnerable |
| Ubuntu | rustc-1.88 | 25.10 | 1.88.0+dfsg0ubuntu1-0ubuntu2 | vulnerable |
| Ubuntu | rustc-1.91 | 25.10 | 1.91.1+dfsg-0ubuntu3~25.10.1 | vulnerable |
| Ubuntu | rustc-1.91 | 26.04 | 1.91.1+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | rustc-1.91 | 26.04 | 1.91.1+dfsg-0ubuntu2 | vulnerable |
| Ubuntu | rustc-1.91 | 26.04 | 1.91.1+dfsg-0ubuntu3 | vulnerable |
| Ubuntu | rustc-1.92 | 26.04 | 1.92.0+dfsg-0ubuntu1 | vulnerable |
| Ubuntu | rustc-1.92 | 26.04 | 1.92.0+dfsg-0ubuntu2 | vulnerable |
| Ubuntu | rustc-1.93 | 26.04 | 1.93.1+dfsg-0ubuntu4 | vulnerable |
| Ubuntu | rustc-1.93 | 26.04 | 1.93.1+dfsg-0ubuntu5 | vulnerable |
| Ubuntu | rustc-1.93 | 26.04 | 1.93.1+dfsg-0ubuntu6 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cargo | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | sid | 1.95.0+dfsg1-2 | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | forky | 1.95.0+dfsg1-2 | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | trixie | 1.85.1+dfsg1-1+deb13u1 | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | rust-cargo | source | sid | 0.91.0-3 | not yet assigned | Not reported | Not reported |
| Debian | rust-cargo | source | forky | 0.91.0-3 | not yet assigned | Not reported | Not reported |
| Debian | rust-cargo | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | rust-cargo | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Cpe | cargo | cpe | Not reported | 1.96.0 | Not reported | Not reported | Not reported |
| Alpine | rust | apk | 3.23 | 1.91.1-r2 | Not reported | ALPINE-CVE-2026-5222 | Not reported |
| Alpine | rust | apk | 3.24 | 1.96.0-r0 | Not reported | ALPINE-CVE-2026-5222 | Not reported |
Notes
[bookworm] cargo: Minor issue [bookworm] rustc: Minor issue [trixie] rust-cargo: Minor issue [bookworm] rust-cargo: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [cargo]Affected
Details (2)
0.66.0+ds1-1· amd64 · bookwormAffected
nvd · cargo · debian · bookworm; nvd · cargo · debian · 12
0.66.0+ds1-1· arm64 · bookwormAffected
nvd · cargo · debian · bookworm; nvd · cargo · debian · 12
- [cargo-doc]Affected
Source package: [cargo]
Details (2)
0.66.0+ds1-1· all · bookwormAffected
nvd · cargo · debian · bookworm; nvd · cargo · debian · 12
0.66.0+ds1-1· all · bookwormAffected
nvd · cargo · debian · bookworm; nvd · cargo · debian · 12
- [librust-cargo-dev]Affected
Source package: [rust-cargo]
Details (2)
0.66.0-1· amd64 · bookwormAffected
nvd · rust-cargo · debian · bookworm; nvd · rust-cargo · debian · 12
0.66.0-1· arm64 · bookwormAffected
nvd · rust-cargo · debian · bookworm; nvd · rust-cargo · debian · 12
- [libstd-rust-1.63]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· arm64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [libstd-rust-dev]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· arm64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [libstd-rust-dev-wasm32]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [libstd-rust-dev-windows]Affected
Source package: [rustc]
Details (1)
1.63.0+dfsg1-2· amd64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rust-all]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rustc]Affected
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· arm64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rust-clippy]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· arm64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rust-doc]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rustfmt]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· arm64 · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rust-gdb]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rust-lldb]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
- [rust-src]Affected
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
1.63.0+dfsg1-2· all · bookwormAffected
nvd · rustc · debian · bookworm; nvd · rustc · debian · 12
[Debian 13 (Trixie)]
- [cargo]Affected
Source package: [rustc]
Details (4)
1.85.0+dfsg3-1· amd64 · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.85.0+dfsg3-1· arm64 · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.94.1+dfsg1-1~bpo13+3· amd64 · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.94.1+dfsg1-1~bpo13+3· arm64 · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
- [cargo-doc]Affected
Source package: [rustc]
Details (20)
1.85.0+dfsg3-1· all · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.85.0+dfsg3-1· all · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.86.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.86.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.87.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.87.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.88.0+dfsg1-2~bpo13+1· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.88.0+dfsg1-2~bpo13+1· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.89.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.89.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.90.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.90.0+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.91.1+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.91.1+dfsg1-1~bpo13+2· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.92.0+dfsg1-2~bpo13+1· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.92.0+dfsg1-2~bpo13+1· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.93.1+dfsg1-2~bpo13+1· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.93.1+dfsg1-2~bpo13+1· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.94.1+dfsg1-1~bpo13+3· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.94.1+dfsg1-1~bpo13+3· all · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
- [librust-cargo-dev]Affected
Source package: [rust-cargo]
Details (2)
0.86.0-2· amd64 · trixieAffected
nvd · rust-cargo · debian · 13
0.86.0-2· arm64 · trixieAffected
nvd · rust-cargo · debian · 13
- [libstd-rust-1.85]Affected
Source package: [rustc]
Details (2)
1.85.0+dfsg3-1· amd64 · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.85.0+dfsg3-1· arm64 · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
- [libstd-rust-dev]Affected
Source package: [rustc]
Details (4)
1.85.0+dfsg3-1· amd64 · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.85.0+dfsg3-1· arm64 · trixieAffected · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.94.1+dfsg1-1~bpo13+3· amd64 · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
1.94.1+dfsg1-1~bpo13+3· arm64 · trixie-backportsFixed · Fixed:
1.85.1+dfsg1-1+deb13u1nvd · rustc · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-5222]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-5222]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-5222]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-5222]
- [https://security-tracker.debian.org/tracker/CVE-2026-5222]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5222.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]