---
id: RUSTSEC-2026-0099
aliases:
  - GHSA-xgp8-3hg3-c2mh
title: Name constraints were accepted for certificates asserting a wildcard name
summary: Name constraints were accepted for certificates asserting a wildcard name
severity: none
vendor: rustls-webpki
product: rustls-webpki
ecosystem: rust
affected:
  - 'rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.6'
patched:
  - rustls-webpki 0.104.0-alpha.6
published: '2026-04-14'
updated: '2026-07-17'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0099'
references:
  - url: 'https://crates.io/crates/rustls-webpki'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0099.html'
tags:
  - osv
  - rust
ingestedAt: '2026-07-17T19:00:51.966Z'
---

## Overview

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to [@1seal](https://github.com/1seal) for the report.

## Affected packages

- `rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.6`

## Remediation

Upgrade to a patched release:

- `rustls-webpki 0.104.0-alpha.6`