CVE-2026-93600

Name of the Vulnerable Software and Affected Versions rustls-webpki versions 0.101.0 through 0.103.11 rustls-webpki versions 0.104.0-alpha through 0.104.0-alpha.5

Description The software ignores X.509 name constraints that apply to URI names, causing these constraints to be accepted instead of enforced. This issue is only reachable after successful signature verification and requires a misissued certificate to exploit. The library does not provide an API for asserting URI names, and URI name constraints are otherwise unimplemented.

Recommendations Update to version 0.103.12. Update to version 0.104.0-alpha.6.