Debian Rust Security Tracker 🩺🦀

RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name

8 affected
Crate
rustls-webpki
Patched Versions
>=0.103.12, <0.104.0-alpha.1
>=0.104.0-alpha.6
Debian Version
0.103.13+ds-1
0.101.7-7
Issued
2026-04-14
Aliases
GHSA-xgp8-3hg3-c2mh
Patched:Affected

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.

Affected Packages

rustls-webpki 0.103.10 hypothesis-client 0.12.0-4+b2
affected ⚠️ librust-rustls-webpki-0.101-dev 0.101.7-7
rustls-webpki 0.103.10 nethsm-pkcs11 2.0.0-2+b2
rustls-webpki 0.103.10 numbat 1.11.0-5+b1
rustls-webpki 0.103.10 prr 0.20.0-2+b2
rustls-webpki 0.103.10 signal-tlsd 0.1.1-1
rustls-webpki 0.103.10 tealdeer 1.8.1-1+b1
rustls-webpki 0.103.10 wasm-bindgen 0.2.108+ds-2+b1