rustls webpki Name Constraints URI Validation Bypass
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 18 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rustls | webpki | 0.101.0 to before 0.103.12; 0.104.0-alpha.1 to before 0.104.0-alpha.6 | 0.103.12, 0.104.0-alpha.6 | Patch available | CNA |
- webpki Vendorrustls Affected 0.101.0 to before 0.103.12; 0.104.0-alpha.1 to before 0.104.0-alpha.6 Fixed in 0.103.12, 0.104.0-alpha.6 Patch available CNA
Remediation
- Fix · CNA webpki (rustls) Fixed in 0.103.12, 0.104.0-alpha.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
rustls webpki 0.103.12, 0.104.0-alpha.6
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-63065 rustls webpki 0.101.0 before 0.103.12 Name Constraint BypassPriority LOW 11
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Cluster Operator | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Applications 8 | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix planned: Out of support scope |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform Ansible Core 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Update Service | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
Not affected: 19 products
- Ansible Automation Orchestrator 2026
- Confidential Compute Attestation
- Lightspeed Services for Advanced Cluster Management
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform Ansible Core 2
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Enterprise Linux command line assistant
- Red Hat Hardened Images
- Red Hat Lightspeed Services for OCP
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat Quay 3
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93600
- 2026-10-03 Alias added: GHSA-fr4g-m728-g2mf
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More rustls vulnerabilities
- TI-2026-63063 rustls-webpki before 0.103.13 Panic via empty BIT STRING CVSS 4.0HIGH 8.7
- TI-2026-86755 Rustls accepts handshake messages at the wrong encryption level CVSS 4.0MEDIUM 6.9
- TI-2026-86753 Key exchange downgrade in rustls via unauthenticated ServerHello CVSS 4.0MEDIUM 6.3
- TI-2026-86752 Uncontrolled memory allocation in rustls Brotli certificate decompression CVSS 4.0MEDIUM 6.3
- TI-2024-21532 Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input CVSS 3.1HIGH 7.5
- TI-2026-86754 Application data sent to public_name server when rustls rejects ECH CVSS 4.0MEDIUM 4.6
Sources
- CVE-2026-93600 · CVE Program
- CVE-2026-93600 · NVD
- FIRST EPSS
- GHSA-fr4g-m728-g2mf · GitHub Advisory Database · CC BY 4.0
- CVE-2026-93600 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences