{
  "cveId": "CVE-2026-5222",
  "url": "https://patchblox.com/security/cve/CVE-2026-5222",
  "summary": "CVE-2026-5222 is fixed in 40 products on 1 platform, first by DEBIAN-CVE-2026-5222, released May 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Cargo can be coerced to share credentials between registries",
  "description": "Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.\u00A0The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.",
  "published": "2026-05-25T10:16:15Z",
  "severity": "Low",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "cwe": "Use of Non-Canonical URL Paths for Authorization Decisions",
  "epss": 0.00478,
  "epssPercentile": 0.41485,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5222",
  "fixes": [
    {
      "platform": "linux",
      "product": "cargo-c",
      "release": "Fedora 43",
      "fixedVersion": "0.10.24-2.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "cargo-c",
      "release": "amzn 2023",
      "fixedVersion": "0.10.19-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-1872",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1872",
      "released": "2026-06-22T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cargo-c-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "0.10.24-2.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "cargo-c-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "0.10.19-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-1872",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1872",
      "released": "2026-06-22T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-hyperlink",
      "release": "Fedora 43",
      "fixedVersion": "1.0.2-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-hyperlink\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "1.0.2-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-hyperlink\u002Bfile-devel",
      "release": "Fedora 43",
      "fixedVersion": "1.0.2-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-hyperlink\u002Bstd-devel",
      "release": "Fedora 43",
      "fixedVersion": "1.0.2-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-hyperlink-devel",
      "release": "Fedora 43",
      "fixedVersion": "1.0.2-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-progress",
      "release": "Fedora 43",
      "fixedVersion": "0.1.4-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-progress\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.1.4-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-progress\u002Bstd-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.1.4-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-anstyle-progress-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.1.4-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo",
      "release": "Debian 14",
      "fixedVersion": "0.91.0-3",
      "fix": "DEBIAN-CVE-2026-5222",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-5222",
      "released": "2026-05-25T10:16:15Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo",
      "release": "Fedora 43",
      "fixedVersion": "0.98.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.98.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo\u002Bhttp-transport-curl-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.98.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo\u002Bhttp-transport-reqwest-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.98.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo\u002Bopenssl-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.98.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-c",
      "release": "Fedora 43",
      "fixedVersion": "0.10.24-2.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-c\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.10.24-2.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-c-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "0.10.24-2.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-c-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "0.10.19-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-1872",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1872",
      "released": "2026-06-22T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-c-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.10.24-2.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-credential-libsecret",
      "release": "Fedora 43",
      "fixedVersion": "0.5.8-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-credential-libsecret\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.5.8-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-credential-libsecret-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.5.8-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.98.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util",
      "release": "Fedora 43",
      "fixedVersion": "0.2.30-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.2.30-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.2.30-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-schemas",
      "release": "Fedora 43",
      "fixedVersion": "0.14.1-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-schemas\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.14.1-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-schemas-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.14.1-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-terminal",
      "release": "Fedora 43",
      "fixedVersion": "0.1.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-terminal\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.1.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-util-terminal-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.1.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-crates-io",
      "release": "Fedora 43",
      "fixedVersion": "0.41.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-crates-io\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.41.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-crates-io-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.41.0-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-rustfix",
      "release": "Fedora 43",
      "fixedVersion": "0.9.7-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-rustfix\u002Bdefault-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.9.7-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rust-rustfix-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.9.7-1.fc43",
      "fix": "FEDORA-2026-CE685F40FE",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-ce685f40fe",
      "released": "2026-08-20T17:06:24Z"
    },
    {
      "platform": "linux",
      "product": "rustc",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.85.1\u002Bdfsg1-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-5222",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-5222",
      "released": "2026-05-25T10:16:15Z"
    },
    {
      "platform": "linux",
      "product": "rustc",
      "release": "Debian 14",
      "fixedVersion": "1.95.0\u002Bdfsg1-2",
      "fix": "DEBIAN-CVE-2026-5222",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-5222",
      "released": "2026-05-25T10:16:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}