Vulnerability RUSTSEC-2026-0481

tdx_workload_attestation::verification::x509::verify_x509_cert(), available with the host-verification feature, checked that issuer_cert issued cert and verified the certificate signature. It did not check the certificate's validity period, so it accepted expired and not-yet-valid certificates.

With the host-gcp-tdx feature, this function validates the GCP launch endorsement signing certificate against the GCE confidential-computing TCB root certificate. A signing certificate outside its validity period was therefore still accepted during launch endorsement verification.

Intel describes the issue as improper certificate validation and classifies it as escalation of privilege, with a CVSS 4.0 base score of 5.9, in INTEL-SA-01520.

The flaw was corrected in #86, released in 0.2.0. The function now returns Ok(false) when the current time is outside the certificate's notBefore/notAfter range.

Reported by Borys Tsyrulnikov.