Vulnerability RUSTSEC-2026-0382

Unknown

15 hours ago

Certificate verification may accept distrusted intermediates

0.0.0-invalid - 0.103.15 and 0.104.0-alpha.1 - 0.104.0-alpha.7

Summary

Certificate verification may accept distrusted intermediates

Details

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys when the configured trust anchors allow such paths. The private keys corresponding to these intermediates are now well known.

Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk

5 months ago

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 GHSA-82j2-j2ch-gfr8

Unknown

6 months ago

Reachable panic in certificate revocation list parsing

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 RUSTSEC-2026-0104

Low Risk

6 months ago

webpki: Name constraints were accepted for certificates asserting a wildcard name

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-xgp8-3hg3-c2mh

Low Risk

6 months ago

webpki: Name constraints for URI names were incorrectly accepted

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-965h-392x-2mh5

Unknown

6 months ago

Name constraints for URI names were incorrectly accepted

0.0.0-invalid - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 RUSTSEC-2026-0098

View all vulnerabilities for these packages

Impacted packages

rustls-webpki

Timeline

Published

15 hours ago

Fixed (0.103.16)

18 hours ago

Fixed (0.104.0-alpha.8)

18 hours ago

Last Modified

2 hours ago