Rust 1.96.1 Patches Cargo HTTP Timeouts and a MIR Miscompilation

The Rust team has pushed out Rust 1.96.1, a point release that addresses two functional bugs and three security vulnerabilities in the libssh2 library bundled with Cargo.

What's fixed

The first fix lands in Cargo's HTTP client: missing retries and timeouts. If you've ever had a cargo build hang indefinitely on a slow network, this is the patch you've been waiting for. The change adds proper timeout handling and retry logic so that transient network failures don't stall your entire workflow.

The second fix is a miscompilation in a MIR optimization pass. MIR (Mid-level Intermediate Representation) is the backbone of Rust's compiler optimizations, and a bug there could produce silently wrong machine code. The Rust team has backported the correction to the 1.96 branch, so if you're on stable, you're now protected.

Three CVEs in libssh2 (which Cargo statically links) are also patched:

• CVE-2025-15661
• CVE-2026-55199
• CVE-2026-55200

These affect SSH-based operations in Cargo, such as fetching from private git repositories over SSH. The details are sparse, but the Rust team recommends updating as soon as possible.

Upgrade now

If you have rustup installed, upgrading is a one-liner:

rustup update stable

If you don't use rustup, grab the installer from the official site.

This release is a reminder that even mature toolchains need constant maintenance. The MIR miscompilation fix is particularly noteworthy — compiler bugs that produce incorrect output are rare in Rust, but when they happen, they demand immediate attention. The Cargo timeout fix is a quality-of-life improvement that should reduce frustration for developers on flaky connections.

For the full list of contributors, see the thanks page.