Update Rust crate cargo to 0.97 [SECURITY] by renovate[bot] · Pull Request #81 · itmettkeDE/cargo-patch

renovate · 2026-06-30T15:07:54Z

This PR contains the following updates:

Package	Type	Update	Change
cargo (source)	dependencies	minor	`0.82` → `0.97`

Cargo can be coerced to share credentials between registries

CVE-2026-5222 / GHSA-p688-r7jv-fm6f

More information

Details

The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.

This vulnerability is tracked as CVE-2026-5222. The severity of the vulnerability is low, due to the extremely niche requirements needed to achieve the attack.

Overview

Originally Cargo only supported storing a registry's index within git repositories. Most git hosting solutions allow accessing a git repository with or without the .git suffix, so Cargo mirrored this behavior when normalizing registry URLs. This allowed credentials for https://example.com/index to be used for https://example.com/index.git.

This normalization was unintentionally applied to the new sparse indexes too. Sparse indexes can be hosted on any HTTPS server, which treat URLs ending with .git as different URLs than those without the suffix.

If the following conditions apply:

https://example.com/index is a sparse index.
https://example.com/index allows crates to depend on crates from any other registry.
The attacker is able to publish crates on https://example.com/index.
The attacker is able to upload arbitrary files to https://example.com/index.git.

...the attacker could configure https://example.com/index.git to be a Cargo sparse registry requiring authentication for downloads, and with a download URL pointing to a server recording any credentials set to it.

When the attacker then publishes a crate foo to https://example.com/index depending on a crate bar from https://example.com/index.git, and tricks the victim into downloading foo, Cargo will think the two registries share the same credential and send the victim's Cargo token to the malicious registry.

Mitigations

Rust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the .git suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo.

Affected versions

All versions of Cargo shipped between Rust 1.68 (the stabilization of sparse registries) and 1.96 are affected.

Acknowledgements

Cargo would like to thank Christos Papakonstantinou for reporting this issue according to the Rust security policy.

Cargo also wants to thank the members of the Rust project who helped address the vulnerability: Arlo Siemens for developing the fix; Weihang Lo, Eric Huss and Emily Albini for reviewing the fix; Emily Albini for writing this advisory; Emily Albini, Josh Stone and Manish Goregaokar for coordinating the disclosure.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Cargo crates in third party registries can override the cached source of other crates

CVE-2026-5223 / GHSA-jq42-7mfv-hm57

More information

Details

The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.

This vulnerability is tracked as CVE-2026-5223. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io are not affected, as crates.io forbids uploading crates containing any symlink.

Overview

When building a crate, Cargo extracts its source code in a local cache (stored within ~/.cargo), reusing it for any future build. Cargo includes protections to prevent any file from being extracted outside of the crate's own cache directory.

It was discovered that it's possible to craft a malicious tarball able to extract files one level below the crate's own cache directory. With the way the cache is structured, that allowed the malicious crate to override the cache of other crates belonging to the same registry.

Mitigations

Rust 1.96.0, to be released on May 28th, 2026, will update Cargo to reject extracting any symlink within crate tarballs, regardless of whether they come from crates.io (which already forbids them) or third-party registries. Note that Cargo never added symlinks when running cargo package or cargo publish, so the impact of this should be minimal.

Users who are not able to upgrade to the most recent Rust version are recommended to audit the contents of their registry for the presence of any symlink, and to configure their registry to reject symlink (if such option is available).

Affected versions

All versions of Cargo shipped before Rust 1.96.0 are affected.

Acknowledgements

Cargo would like to thank Christos Papakonstantinou for reporting this to us according to the Rust security policy.

Cargo also wants to thank the members of the Rust project who helped address the vulnerability: Josh Triplett for developing the fix; Arlo Siemsen for reviewing the fix; Emily Albini for writing this advisory; Emily Albini, Josh Stone and Manish Goregaokar for coordinating the disclosure; Ed Page and Eric Huss for advising during the disclosure.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

rust-lang/cargo (cargo)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-30T15:07:56Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace
    Updating crates.io index
error: failed to select a version for `libgit2-sys`.
    ... required by package `cargo v0.97.0`
    ... which satisfies dependency `cargo = "^0.97"` of package `cargo-patch v0.3.2 (/tmp/renovate/repos/github/itmettkeDE/cargo-patch)`
versions that meet the requirements `^0.18.3` are: 0.18.7+1.9.6, 0.18.6+1.9.5, 0.18.5+1.9.4, 0.18.4+1.9.3, 0.18.3+1.9.2

package `libgit2-sys` links to the native library `git2`, but it conflicts with a previous package which links to `git2` as well:
package `libgit2-sys v0.17.0+1.8.1`
    ... which satisfies dependency `libgit2-sys = "^0.17.0"` of package `git2 v0.19.0`
    ... which satisfies dependency `git2 = "^0.19.0"` of package `cargo-test-support v0.3.0`
    ... which satisfies dependency `cargo-test-support = "^0.3"` of package `cargo-patch v0.3.2 (/tmp/renovate/repos/github/itmettkeDE/cargo-patch)`
note: only one package in the dependency graph may specify the same links value to ensure that only one copy of a native library is linked in the final binary
for more information, see https://doc.rust-lang.org/cargo/reference/resolver.html#links
help: try to adjust your dependencies so that only one package uses the `links = "git2"` value

failed to select a version for `libgit2-sys` which could resolve this conflict

Update Rust crate cargo to 0.97 [SECURITY]

8e14fe8

Navigation Menu

Uh oh!

Update Rust crate cargo to 0.97 [SECURITY] - #81

Update Rust crate cargo to 0.97 [SECURITY]#81
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/crate-cargo-vulnerability

renovate Bot commented Jun 30, 2026

Uh oh!

renovate Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 30, 2026

Cargo can be coerced to share credentials between registries

Details

Overview

Mitigations

Affected versions

Acknowledgements

Severity

References

Cargo crates in third party registries can override the cached source of other crates

Details

Overview

Mitigations

Affected versions

Acknowledgements

Severity

References

Release Notes

Configuration

Uh oh!

renovate Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: Cargo.lock

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 30, 2026 •

edited

Loading