RUSTSEC-2026-0099
NoneCVSS
—
EPSS
—
Published
Apr 14, 2026
CISA due date
—
The record
Name constraints were accepted for certificates asserting a wildcard name
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | rustls-webpki | 0.0.0-0 | 0.103.12 |
| crates.io | rustls-webpki | 0.101.0 | 0.103.12 |
| crates.io | rustls-webpki | 0.104.0-alpha.1 | 0.104.0-alpha.6 |
Related vulnerabilities
- RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsing Also affects rustls-webpki
- RUSTSEC-2026-0098 Name constraints for URI names were incorrectly accepted Also affects rustls-webpki
- RUSTSEC-2026-0049 CRLs not considered authoritative by Distribution Point due to faulty matching logic Also affects rustls-webpki