Log in Start free

Vulnerability · Published May 25, 2026 · Assigned by rust

CVE-2026-5223Crates in third party registries can override the cached source of other crates

Medium 6.5

In plain English

A medium-severity security flaw in Cargo from Rust Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.5Medium
Exploit odds (30 days)0.3%top 77.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24chromium-rust1.96.0-r0ALPINE-CVE-2026-5223
Alpine:v3.23rust1.91.1-r2ALPINE-CVE-2026-5223
Alpine:v3.24rust1.96.0-r0ALPINE-CVE-2026-5223
Debian:12cargono fix listedDEBIAN-CVE-2026-5223
Debian:12rust-cargono fix listedDEBIAN-CVE-2026-5223
Debian:13rust-cargono fix listedDEBIAN-CVE-2026-5223
Debian:14rust-cargo0.91.0-3DEBIAN-CVE-2026-5223
Debian:12rustcno fix listedDEBIAN-CVE-2026-5223
Debian:13rustc1.85.1+dfsg1-1+deb13u1DEBIAN-CVE-2026-5223
Debian:14rustc1.95.0+dfsg1-2DEBIAN-CVE-2026-5223
Ubuntu:22.04:LTSrustcno fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustcno fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.62no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.74no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.76no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.76no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.77no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.77no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.78no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.78no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.79no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.79no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.80no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.80no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.81no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.81no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.82no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.82no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.83no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.83no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.84no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.84no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.85no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.85no fix listedUBUNTU-CVE-2026-5223
Ubuntu:25.10rustc-1.85no fix listedUBUNTU-CVE-2026-5223
Ubuntu:25.10rustc-1.88no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.89no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.89no fix listedUBUNTU-CVE-2026-5223
Ubuntu:22.04:LTSrustc-1.91no fix listedUBUNTU-CVE-2026-5223
Ubuntu:24.04:LTSrustc-1.91no fix listedUBUNTU-CVE-2026-5223
Ubuntu:25.10rustc-1.91no fix listedUBUNTU-CVE-2026-5223
Ubuntu:26.04:LTSrustc-1.91no fix listedUBUNTU-CVE-2026-5223
Ubuntu:26.04:LTSrustc-1.92no fix listedUBUNTU-CVE-2026-5223
Ubuntu:26.04:LTSrustc-1.93no fix listedUBUNTU-CVE-2026-5223

Affected products (as reported)

VendorProductVersions
Rust Project Cargo 1.0.0 – before 1.96.0

Weakness: CWE-61 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References