Spurious network error 503 on updating crates.io index behind proxy since 1.89.0

Problem

Since cargo 1.89.0 including current version (1.91.0) cargo is unable to download the registry manifest or crates. We are seeing spurious network warning when cargo tries to update from crates.io behind an authenticated proxy due to 503 being returned (likely from the proxy?):

warning: spurious network error (3 tries remaining): failed to get successful HTTP response from `https://index.crates.io/config.json` (18.239.236.15), got 503

Version 1.88.0 works fine and we are pinned to it.

OS: RHEL8 (8.9), RHEL9 (9.6)
(behaves the same in both versions of redhat)

Log is attached that shows the log output.

cargo_update.log

No combination of exposed settings makes any difference. Using --config registries.creates-io.protocol=\'git\' allows downloading the index but later fails in the same way when downloading the crates themselves. Using net.git-fetch-cli-with-cli=true makes no difference (likely because it is only used to download crates, not fetching the index).

The most likely cause is some interaction with the proxy. However running plain curl

curl https://index.crates.io/config.json

works just fine. Setting no proxy yields connection refused. Setting proxy without auth yields 407. Setting proxy with auth yields the above problem.

Looking at the relevant cargo code I do not see any outstanding setting that could lead to a difference in behaviour but I am not too familiar with the codebase.

Steps

export CARGO_LOG=debug
export CARGO_HTTP_DEBUG=true
cargo update

Possible Solution(s)

None (pin to cargo 1.88)

Notes

No response

Version

cargo 1.91.1 (ea2d97820 2025-10-10)
release: 1.91.1
commit-hash: ea2d97820c16195b0ca3fadb4319fe512c199a43
commit-date: 2025-10-10
host: x86_64-unknown-linux-gnu
libgit2: 1.9.1 (sys:0.20.2 vendored)
libcurl: 8.15.0-DEV (sys:0.4.83+curl-8.15.0 vendored ssl:OpenSSL/3.5.2)
ssl: OpenSSL 3.5.2 5 Aug 2025
os: Red Hat Enterprise Linux 9.6.0 [64-bit]

Start by reproducing cargo update with CARGO_LOG=debug and CARGO_HTTP_DEBUG=true through an authenticated proxy, comparing Cargo 1.88.0 with 1.89.0 or later. Check the attached cargo_update.log and verify the fix allows both the crates.io index and crate downloads to succeed without 503 errors.