Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: rustls webpki 0.103.12, 0.104.0-alpha.6 Clear all filters
TI-2026-63065 CVE-2026-93601 · GHSA-27hx-xqx9-p6hq

rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

Priority LOW 11

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00203 Published 2026-09-18 Partial fix · 0.103.12, 0.104.0-alpha.6 CWE-295
TI-2026-63064 CVE-2026-93600 · GHSA-fr4g-m728-g2mf

rustls webpki Name Constraints URI Validation Bypass

Priority LOW 11

rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than…

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00203 Published 2026-09-18 Partial fix · 0.103.12, 0.104.0-alpha.6 CWE-295