RUSTSEC-2026-0099None▾ SunlitName constraints were accepted for certificates asserting a wildcard name
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint.
This is very similar to CVE-2025-61727.
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.
rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.6Upgrade to a patched release:
rustls-webpki 0.104.0-alpha.6Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0104NoneReachable panic in certificate revocation list parsing
RUSTSEC-2026-0098NoneName constraints for URI names were incorrectly accepted
RUSTSEC-2026-0049NoneCRLs not considered authoritative by Distribution Point due to faulty matching logic