rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List

A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...

CVE-2026-93601

A flaw was found in rustls-webpki. This component incorrectly processes DNS Domain Name System name constraints for certificates asserting a wildcard name. This could allow a misissued wildcard certificate to be accepted for a domain that should be outside its permitted scope. Consequently, this...

CVE-2026-93600

A flaw was found in rustls-webpki where the library incorrectly ignores X.509 name constraints that apply to Uniform Resource Identifier URI names. This issue causes these constraints to be accepted rather than properly enforced. Exploitation requires a misissued certificate and successful...

CVE-2026-93599

A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...

CVE-2026-93602

A flaw was found in rustls-webpki. The component contains faulty Certificate Revocation List CRL authority-matching logic, which incorrectly compares only the first distribution point against each CRL's issuing distribution point, ignoring others. This vulnerability allows an attacker with a...

SUSE CVE-2026-93599

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

SUSE CVE-2026-93600

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

SUSE CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

SUSE CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

Linux Distros Unpatched Vulnerability : CVE-2026-93601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name...

Linux Distros Unpatched Vulnerability : CVE-2026-93600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI...

Linux Distros Unpatched Vulnerability : CVE-2026-93599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fai...

Linux Distros Unpatched Vulnerability : CVE-2026-93602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against ea...

CVE-2026-93600

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

AZL-103460 CVE-2026-93601 affecting package kata-containers-cc 3.15.0.aks0-21

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

AZL-103515 CVE-2026-93600 affecting package rust 1.96.1-2

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

AZL-103524 CVE-2026-93602 affecting package rust-afterburn 5.8.2-2

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

AZL-103521 CVE-2026-93601 affecting package rust-afterburn 5.8.2-2

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

AZL-103518 CVE-2026-93599 affecting package rust-afterburn 5.8.2-2

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...