Read the docs

rustls

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

rustls records in CISA KEV

No rustls vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-63063 CVE-2026-93599 · GHSA-g42g-9vm4-7gfj

rustls-webpki before 0.103.13 Panic via empty BIT STRING

Priority HIGH 77

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00346 Published 2026-09-18 Partial fix · 0.103.13, 0.104.0-alpha.7 CWE-191
TI-2026-63066 CVE-2026-93602 · GHSA-8hrm-p5h4-6vcx

rustls-webpki before 0.103.10 CRL Revocation Check Bypass

Priority LOW 26

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distr…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.002 Published 2026-09-18 Partial fix · 0.103.10, 0.104.0-alpha.5 CWE-299
TI-2026-63065 CVE-2026-93601 · GHSA-27hx-xqx9-p6hq

rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

Priority LOW 11

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00203 Published 2026-09-18 Partial fix · 0.103.12, 0.104.0-alpha.6 CWE-295
TI-2026-63064 CVE-2026-93600 · GHSA-fr4g-m728-g2mf

rustls webpki Name Constraints URI Validation Bypass

Priority LOW 11

rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than…

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00203 Published 2026-09-18 Partial fix · 0.103.12, 0.104.0-alpha.6 CWE-295
Open these records in search →