{"id":"CVE-2026-93601","title":"rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name","summary":"rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name…","severity":"low","cvss":2.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-295","CWE-1289"],"vendor":"rustls","product":"webpki","affected":["webpki >= 0.101.0 < 0.103.12","webpki >= 0.104.0-alpha.1 < 0.104.0-alpha.6"],"patched":["rustls-webpki 0.104.0-alpha.6"],"published":"2026-09-18","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:25:55.870","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93601","references":[{"url":"https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rustls-webpki-0.101.0-before-0.103.12-name-constraint-bypass","label":"disclosure@vulncheck.com"},{"url":"https://crates.io/crates/rustls-webpki"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0099.html"},{"url":"https://github.com/rustls/webpki"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93601.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93601"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538656"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93601"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93601"}],"tags":["nvd","cve.org","osv","rust","csaf","vex","red-hat"],"epss":0.00183,"epssPercentile":0.08102,"aliases":["RUSTSEC-2026-0099","GHSA-xgp8-3hg3-c2mh"],"ecosystem":"rust","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-18T17:49:32.542670Z"},"ingestedAt":"2026-09-18T13:41:41.663Z","slug":"CVE-2026-93601","body":"## Overview\n\nrustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-93601)\n\nAffected packages:\n\n- `rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.6`\n\nPatched in:\n\n- `rustls-webpki 0.104.0-alpha.6`\n\nSource: https://osv.dev/vulnerability/RUSTSEC-2026-0099\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Confidential Cluster Operator, Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Applications 8, OpenShift Lightspeed, OpenShift Service Mesh 3, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Applications 8, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93601.json)","depth":"sunlit","depthScore":12,"depthScoreParts":{"impact":12.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}