RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted

What to do

1. See which version you have: cargo tree -i rustls-webpki (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rustls-webpki. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rustls-webpki = "0.104.0-alpha.6") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-965h-392x-2mh5. Thank you to @1seal for the report.

References

• Package: crates.io/crates/rustls-webpki
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0098.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rustls-webpki

• Vulnerability HighRUSTSEC-2023-0053 · 2023-08-22rustls-webpki: CPU denial of service in certificate path building
• VulnerabilityRUSTSEC-2026-0049 · 2026-03-20CRLs not considered authoritative by Distribution Point due to faulty matching logic
• VulnerabilityRUSTSEC-2026-0099 · 2026-04-14Name constraints were accepted for certificates asserting a wildcard name
• VulnerabilityRUSTSEC-2026-0104 · 2026-04-22Reachable panic in certificate revocation list parsing
• VulnerabilityRUSTSEC-2026-0382 · 2026-10-20Certificate verification may accept distrusted intermediates

Full security history of rustls-webpki