GHSA-xgp8-3hg3-c2mh

Suggest an improvement
Source
https://github.com/advisories/GHSA-xgp8-3hg3-c2mh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xgp8-3hg3-c2mh/GHSA-xgp8-3hg3-c2mh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xgp8-3hg3-c2mh
Aliases
Downstream
CGA (141)
MINI (24)
Published
2026-04-16T21:17:12Z
Modified
2026-09-19T03:55:49Z
Severity
  • 2.2 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
webpki: Name constraints were accepted for certificates asserting a wildcard name
Details

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

Database specific 
{
    "cwe_ids":  [
        "CWE-295"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-16T21:17:12Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

crates.io / rustls-webpki

Package

Name
rustls-webpki
View open source insights on deps.dev
Purl
pkg:cargo/rustls-webpki

Affected ranges

Type
SEMVER
Events
Introduced
0.101.0
Fixed
0.103.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xgp8-3hg3-c2mh/GHSA-xgp8-3hg3-c2mh.json"

crates.io / rustls-webpki

Package

Name
rustls-webpki
View open source insights on deps.dev
Purl
pkg:cargo/rustls-webpki

Affected ranges

Type
SEMVER
Events
Introduced
0.104.0-alpha.1
Fixed
0.104.0-alpha.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xgp8-3hg3-c2mh/GHSA-xgp8-3hg3-c2mh.json"