RUSTSEC-2026-0049
NoneCVSS
—
EPSS
—
Published
Mar 20, 2026
CISA due date
—
The record
CRLs not considered authoritative by Distribution Point due to faulty matching logic
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | rustls-webpki | 0.102.0-alpha.0 | 0.103.10 |
| crates.io | rustls-webpki | 0.104.0-alpha.1 | 0.104.0-alpha.5 |
Related vulnerabilities
- RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsing Also affects rustls-webpki
- RUSTSEC-2026-0098 Name constraints for URI names were incorrectly accepted Also affects rustls-webpki
- RUSTSEC-2026-0099 Name constraints were accepted for certificates asserting a wildcard name Also affects rustls-webpki