Rust advisories / rustls-webpki
Vulnerability LowRUSTSEC-2026-0099 · rustls-webpki
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Short answerA security vulnerability in the rustls-webpki crate: Name constraints were accepted for certificates asserting a wildcard name. GitHub rates it Low. Fixed in 0.103.12, 0.104.0-alpha.6: update to a fixed version.
| Crate | rustls-webpki |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.103.12; from 0.104.0-alpha.1 before 0.104.0-alpha.6. |
| Fixed in | 0.103.12, 0.104.0-alpha.6 |
| Severity | Low (GitHub rating) |
| Published | 2026-04-14 |
| Last changed | 2026-09-19 |
| Also known as | CVE-2026-93601, GHSA-xgp8-3hg3-c2mh |
What to do
- See which version you have:
cargo tree -i rustls-webpki(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p rustls-webpki. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplerustls-webpki = "0.104.0-alpha.6") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.
References
- Package: crates.io/crates/rustls-webpki
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0099.html
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for rustls-webpki
- Vulnerability HighRUSTSEC-2023-0053 · 2023-08-22rustls-webpki: CPU denial of service in certificate path building
- VulnerabilityRUSTSEC-2026-0049 · 2026-03-20CRLs not considered authoritative by Distribution Point due to faulty matching logic
- VulnerabilityRUSTSEC-2026-0098 · 2026-04-14Name constraints for URI names were incorrectly accepted
- VulnerabilityRUSTSEC-2026-0104 · 2026-04-22Reachable panic in certificate revocation list parsing
- VulnerabilityRUSTSEC-2026-0382 · 2026-10-20Certificate verification may accept distrusted intermediates
Up next
Same craterustls-webpki: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?