crates.io

RUSTSEC-2026-0382

crates.io/rustls-webpki

Certificate verification may accept distrusted intermediates yesterday

Fix available

RUSTSEC-2026-0346

crates.io/rustls

`Debug` impls for client session values expose TLS secrets 14 Oct

Fix available
Severity - 4.0 (Medium)

RUSTSEC-2026-0347

crates.io/rustls

Buffered application data sent to outer server after ECH rejection 14 Oct

Fix available
Severity - 2.3 (Low)

RUSTSEC-2026-0348

crates.io/rustls

Brotli certificate decompression can allocate up to 1 GiB before authentication 14 Oct

Fix available
Severity - 3.7 (Low)

RUSTSEC-2026-0349

crates.io/rustls

Unauthenticated ServerHello can downgrade later connections to classical key... 14 Oct

Fix available
Severity - 3.7 (Low)

GHSA-2mjx-qc3c-rqvc

crates.io/rustls

Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries 05 Oct

Fix available
Severity - 5.3 (Medium)

RUSTSEC-2026-0285

crates.io/rustls

TLS 1.3 handshake messages incorrectly accepted across encryption level... 14 Sep

Fix available
Severity - 5.3 (Medium)

GHSA-82j2-j2ch-gfr8

crates.io/rustls-webpki

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING 24 Apr

Fix available
Severity - 7.5 (High)

RUSTSEC-2026-0104

crates.io/rustls-webpki

Reachable panic in certificate revocation list parsing 22 Apr

Fix available

GHSA-xgp8-3hg3-c2mh

crates.io/rustls-webpki

webpki: Name constraints were accepted for certificates asserting a wildcard name 16 Apr

Fix available
Severity - 2.2 (Low)

GHSA-965h-392x-2mh5

crates.io/rustls-webpki

webpki: Name constraints for URI names were incorrectly accepted 16 Apr

Fix available
Severity - 2.2 (Low)

RUSTSEC-2026-0098

crates.io/rustls-webpki

Name constraints for URI names were incorrectly accepted 14 Apr

Fix available

RUSTSEC-2026-0099

crates.io/rustls-webpki

Name constraints were accepted for certificates asserting a wildcard name 14 Apr

Fix available

GHSA-pwjx-qhcg-rvj4

crates.io/rustls-webpki

webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic 20 Mar

Fix available
Severity - 4.4 (Medium)

RUSTSEC-2026-0049

crates.io/rustls-webpki

CRLs not considered authoritative by Distribution Point due to faulty matching logic 20 Mar

Fix available

RUSTSEC-2025-0134

crates.io/rustls-pemfile

rustls-pemfile is unmaintained 28 Nov 2025

No fix available

Vulnerabilities