RUSTSEC-2026-0382: Certificate verification may accept distrusted intermediates

What to do

1. See which version you have: cargo tree -i rustls-webpki (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rustls-webpki. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rustls-webpki = "0.104.0-alpha.8") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys when the configured trust anchors allow such paths. The private keys corresponding to these intermediates are now well known.

Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.

References

• Package: crates.io/crates/rustls-webpki
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0382.html
• Web: github.com/rustls/webpki/pull/546
• Web: emudhra.we-have-a-problem.com/
• Web: bugzilla.mozilla.org/show_bug.cgi?id=2083449

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rustls-webpki

• Vulnerability HighRUSTSEC-2023-0053 · 2023-08-22rustls-webpki: CPU denial of service in certificate path building
• VulnerabilityRUSTSEC-2026-0049 · 2026-03-20CRLs not considered authoritative by Distribution Point due to faulty matching logic
• VulnerabilityRUSTSEC-2026-0098 · 2026-04-14Name constraints for URI names were incorrectly accepted
• VulnerabilityRUSTSEC-2026-0099 · 2026-04-14Name constraints were accepted for certificates asserting a wildcard name
• VulnerabilityRUSTSEC-2026-0104 · 2026-04-22Reachable panic in certificate revocation list parsing

Full security history of rustls-webpki