PkgSeer

Vulnerability GHSA-965h-392x-2mh5

Low Risk

6 months ago

webpki: Name constraints for URI names were incorrectly accepted

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5

Summary

webpki: Name constraints for URI names were incorrectly accepted

Details

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Certificate verification may accept distrusted intermediates

0.0.0-invalid - 0.103.15 and 0.104.0-alpha.1 - 0.104.0-alpha.7 RUSTSEC-2026-0382

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 GHSA-82j2-j2ch-gfr8

Reachable panic in certificate revocation list parsing

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 RUSTSEC-2026-0104

webpki: Name constraints were accepted for certificates asserting a wildcard name

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-xgp8-3hg3-c2mh

Name constraints for URI names were incorrectly accepted

0.0.0-invalid - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 RUSTSEC-2026-0098

View all vulnerabilities for these packages

Impacted packages

rustls-webpki

Timeline

Published

6 months ago

Fixed (0.104.0-alpha.6)

6 months ago

Fixed (0.103.12)

6 months ago

Last Modified

1 month ago