Rust 1.96.1 patches Cargo timeouts, security flaws, and MIR miscompilation

Rust 1.96.1 landed on June 30 with Cargo timeout fixes, libssh2 security patches, and a rustc repair for a MIR optimization miscompilation. Released just 33 days after Rust 1.96.0, it reads as a maintenance stop, not a feature drop. For stable teams, the payoff is immediate: fewer flaky fetches in CI, fewer SSH transport surprises, and one less compiler correctness bug hiding in generated code.

The Cargo side is the part that will hit real workflows first. The release notes call out a fix for timeout and retry behavior, plus patches to Cargo’s libssh2 dependency for CVE-2025-15661, CVE-2026-55199, and CVE-2026-55200. GitHub’s advisory for CVE-2026-55199 says a malicious SSH server can trap a client in a CPU exhaustion loop during key exchange because the session timeout does not apply to CPU-bound loops. The advisory for CVE-2026-55200 says crafted SSH packets with oversized packet_length values can corrupt heap memory and may allow remote code execution.

That makes this a patch release to take seriously, not a note to file away for later. If your Cargo workflow leans on SSH-based registries, mirrors, or source fetches, update through rustup now. If your stable setup is a small local project with no exposed transport path, you can fold it into the next routine toolchain bump, but the release still belongs on the radar. Rust 1.96.1 is listed as the current stable version, so the fix comes through the normal stable channel.

The timing fits a pattern the Rust Security Response Team has already set this year. On March 21, 2026, it warned about CVE-2026-33056 in Cargo’s tar dependency and said crates.io had deployed a mitigation on March 13, audited every crate ever published, and found no crates exploiting the issue. That response showed how quickly the project will move when package tooling crosses into security territory, and 1.96.1 extends that same posture from extraction bugs to SSH transport and compiler output.

For anyone watching CI logs, Cargo fetches, or generated code, 1.96.1 is the maintenance patch that turns three hard-to-diagnose failure modes into a routine stable update.