CVE-2026-93601: rustls-webpki name constraint bypass for wildcard certificates

CVE-2026-93601 · Severity: low · CVSS 3.1 · Published 2026-09-18

rustls-webpki is a certificate validation library used by the Rust TLS implementation. A flaw in name constraint validation allows wildcard certificates to bypass DNS name restrictions that were otherwise properly issued. An attacker with a misissued wildcard certificate could assert domain names outside their permitted scope, potentially enabling domain impersonation attacks.

Technologies: rustls-webpki (crates.io), Rustls Webpki. Vendors: crates.io, Rustls.

Quick answers

Is CVE-2026-93601 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93601 being exploited in the wild.
How severe is CVE-2026-93601?
Low severity, with a CVSS score of 3.1, published 18 September 2026.
Which products and versions are affected?
rustls-webpki (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.103.12,introduced=0.104.0-alpha.1,fixed=0.104.0-alpha.6, SEMVER:introduced=0.101.0,fixed=0.103.12; Rustls Webpki >= 0.101.0, < 0.103.12; >= 0.104.0-alpha.1, < 0.104.0-alpha.6.
Is there a fix for CVE-2026-93601?
Yes. rustls-webpki (crates.io): upgrade to 0.103.12, 0.104.0-alpha.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93601 attacked?
It is attacked over the network.
Am I affected by CVE-2026-93601?
Check whether you run rustls-webpki (crates.io) or Rustls Webpki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rustls-webpki (crates.io): upgrade to 0.103.12, 0.104.0-alpha.6 or later
    cargo update -p rustls-webpki

Technical details

The vulnerability is an improper certificate validation (CWE-295) in name constraint handling. When a certificate asserts a wildcard DNS name (e.g., *.example.com), the library incorrectly accepted permitted-subtree name constraints as satisfied. For example, a constraint of accept.example.com would be satisfied by *.example.com, which could feasibly cover reject.example.com—a name outside the permitted subtree. This occurs only after signature verification succeeds and requires a misissued wildcard certificate to reach. Patches are available in versions 0.103.12 and 0.104.0-alpha.6 or later.

Affected products

  • rustls webpki >= 0.101.0, < 0.103.12; >= 0.104.0-alpha.1, < 0.104.0-alpha.6

Identifiers

  • CVE-2026-93601
  • GHSA-xgp8-3hg3-c2mh
  • RUSTSEC-2026-0099

Timeline

  • 2026-04-15: disclosed: GitHub security advisory published
  • 2026-09-18: advisory: CVE-2026-93601 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.