Rust 1.96.1 Released With Critical Cargo Security Patches
Rust 1.96.1 has landed, and it brings three critical CVE patches to Cargo alongside a quiet compiler fix. The Rust team pushed the point release today to address a miscompilation bug in the MIR optimization pass and a lingering issue in the HTTP client that would silently drop requests instead of retrying them.
Updating is straightforward if you already track the toolchain via rustup. Just run rustup update stable and you are good to go. Keep in mind that the Cargo HTTP client patch is separate from the security fixes, but it will save you from some frustrating dead ends when fetching crates from flaky registries.
The libssh2 Vulnerabilities
The real reason to patch immediately involves three CVEs in libssh2, the SSH library Cargo bundles into its transport layer. Anyone pulling Git repositories or authenticating to remote package registries is exposed until they update.
CVE-2026-55200 is an out-of-bounds write triggered by a malicious SSH packet with an inflated packet_length field. In the right conditions, an attacker could corrupt heap memory and push for remote code execution. CVE-2025-15661 is a heap over-read in sftp_symlink() that leaks memory or crashes the client when a server crafts a malformed SSH_FXP_NAME response. CVE-2026-55199 rounds out the trio with a CPU exhaustion loop that hangs clients for over a minute during key exchange because the session timeout does not apply to pure compute-bound spins.
Cargo has maintained a somewhat rocky relationship with libssh2 over the years. The core team has been gradually consolidating its SSH transport to rely on libgit2 instead, which would sidestep these specific attack surfaces entirely. That migration is still a work in progress, so this patch is non-negotiable for anyone using SSH-based workflows.
The Broader Picture
The release arrives as Rust continues to lock in its position across modern infrastructure. OpenAI joined the Rust Foundation as a platinum member last month, slotting in alongside AWS, Google, Microsoft, Meta, and Huawei. The language has now maintained backward compatibility for more than a decade since hitting 1.0, a track record that keeps enterprise architecture teams sleeping better at night.
The compiler fix itself targets a specific MIR optimization that could corrupt code generation under heavy generic instantiation. If you hit strange crashes with the previous release on edge-case code, that is almost certainly what this addresses. Next, the 1.96.1 toolchain ships with updated standard library headers and a handful of quiet internal cleanup commits that do not impact downstream builds.
Head here to the official Rust releases page for the full changelog and download links. If you are actively tracking Cargo specifically, you might want to audit your SSH transport layer setup while you are at it.
