Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93601rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass
Low 2.2
In plain English
A low-severity improper certificate validation in webpki from rustls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-rustls-webpki | no fix listed | DEBIAN-CVE-2026-93601 |
| Debian:14 | rust-rustls-webpki | 0.103.13+ds-1 | DEBIAN-CVE-2026-93601 |
| Ubuntu:24.04:LTS | rust-rustls-webpki | no fix listed | UBUNTU-CVE-2026-93601 |
| Ubuntu:26.04:LTS | rust-rustls-webpki | no fix listed | UBUNTU-CVE-2026-93601 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-xgp8-3hg3-c2mh) vendor-advisory
- VulnCheck Advisory: rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass third-party-advisory