CVE-2026-93601

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93601
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93601.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93601
Aliases
Downstream
Published
2026-09-18T13:20:11Z
Modified
2026-09-19T03:55:49Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass
Details

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93601.json"
}
References

Affected packages

Git / github.com/rustls/webpki

Affected ranges

Type
GIT
Repo
https://github.com/rustls/webpki
Events
Introduced
05e736fd927e3b0c28bb5b24b2bed684b32e1485
Fixed
27131d476e2b68a537e629d6d012bef8dad6efd3
Introduced
5a23b7e1c7b6e898d6bb437730a029b2695aa3eb
Fixed
2c2d56b2090127d555d6d9b910d2a9e288259e54
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.101.0"
        },
        {
            "fixed": "0.103.12"
        },
        {
            "introduced": "0.104.0-alpha.1"
        },
        {
            "fixed": "0.104.0-alpha.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v/0.*
v/0.104.0-alpha.1
v/0.104.0-alpha.2
v/0.104.0-alpha.3
v/0.104.0-alpha.4
v/0.104.0-alpha.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93601.json"