PkgSeer

Vulnerability RUSTSEC-2026-0098

Unknown

6 months ago

Name constraints for URI names were incorrectly accepted

0.0.0-invalid - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5

Summary

Name constraints for URI names were incorrectly accepted

Details

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-965h-392x-2mh5. Thank you to @1seal for the report.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Certificate verification may accept distrusted intermediates

0.0.0-invalid - 0.103.15 and 0.104.0-alpha.1 - 0.104.0-alpha.7 RUSTSEC-2026-0382

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 GHSA-82j2-j2ch-gfr8

Reachable panic in certificate revocation list parsing

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 RUSTSEC-2026-0104

webpki: Name constraints were accepted for certificates asserting a wildcard name

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-xgp8-3hg3-c2mh

webpki: Name constraints for URI names were incorrectly accepted

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-965h-392x-2mh5

View all vulnerabilities for these packages

Impacted packages

rustls-webpki

Timeline

Published

6 months ago

Fixed (0.104.0-alpha.6)

6 months ago

Fixed (0.103.12)

6 months ago

Last Modified

1 month ago