Fedora Rust-Cargo Information Disclosure Vulnerabilities 2026

Multiple information disclosure vulnerabilities have been identified in Fedora's Rust-Cargo packages, primarily affecting versions 0.10.24 and earlier. The vulnerabilities, cataloged under CVE-2026-5222, arise from a URL normalization flaw that could potentially expose sensitive data. Affected systems include Fedora 43 and 44, with updates released to mitigate these risks. The vulnerabilities were disclosed on May 25, 2026, and have since been addressed with patches. Users are advised to update their systems using the 'dnf' package manager to the latest versions. The updates include various packages related to Rust-Cargo, which are critical for managing Rust dependencies. The advisory emphasizes the importance of applying these updates promptly to safeguard against potential exploitation.

Key Points: • CVE-2026-5222 affects Fedora Rust-Cargo versions 0.10.24 and earlier. • The vulnerabilities stem from a URL normalization flaw leading to information disclosure. • Patches are available, and users should update their systems immediately.