CVE-2026-93600

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93600
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93600.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93600
Aliases
Downstream
Published
2026-09-18T13:20:10Z
Modified
2026-09-19T03:55:32Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
rustls webpki Name Constraints URI Validation Bypass
Details

rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93600.json"
}
References

Affected packages

Git / github.com/rustls/webpki

Affected ranges

Type
GIT
Repo
https://github.com/rustls/webpki
Events
Introduced
05e736fd927e3b0c28bb5b24b2bed684b32e1485
Fixed
27131d476e2b68a537e629d6d012bef8dad6efd3
Introduced
5a23b7e1c7b6e898d6bb437730a029b2695aa3eb
Fixed
2c2d56b2090127d555d6d9b910d2a9e288259e54
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.101.0"
        },
        {
            "fixed": "0.103.12"
        },
        {
            "introduced": "0.104.0-alpha.1"
        },
        {
            "fixed": "0.104.0-alpha.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v/0.*
v/0.104.0-alpha.1
v/0.104.0-alpha.2
v/0.104.0-alpha.3
v/0.104.0-alpha.4
v/0.104.0-alpha.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93600.json"