news
New Security Defects in Rust
-
Rust Blog ☛ The Rust Programming Language Blog: Security Advisory for Cargo (CVE-2026-5223) [Ed: Rust security anything but perfect, more things that can go wrong in Rust itself]
The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.
-
Rust Blog ☛ The Rust Programming Language Blog: Security Advisory for Cargo (CVE-2026-5222)
The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.