# rustls-webpki: CPU denial of service in certificate path building

Source: https://junglewise.ai/threats/rustls-webpki-cpu-denial-of-service-in-certificate-path-building-3f07ea21  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-22  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3 · Published 2023-08-22

rustls-webpki: CPU denial of service in certificate path building

Technologies: [rustls-webpki (crates.io)](https://junglewise.ai/threats/technologies/rustls-webpki). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3, published 22 August 2023.

**Which products and versions are affected?** rustls-webpki (crates.io) SEMVER:introduced=0,fixed=0.100.2.

**Is there a fix for This vulnerability?** Yes. rustls-webpki (crates.io): upgrade to 0.100.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run rustls-webpki (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rustls-webpki (crates.io): upgrade to 0.100.2 or later

  ```sh
  cargo update -p rustls-webpki
  ```


## Affected products

- rustls-webpki (crates.io) SEMVER:introduced=0,fixed=0.100.2

## Related threats

- [Go crypto/x509 untrusted intermediate certificate validation](https://junglewise.ai/threats/cve-2026-111943-on-most-platforms-go-uses-the-given-system-root-certificates)
- [rustls-webpki CRL distribution point matching bypass](https://junglewise.ai/threats/cve-2026-93602-rustls-webpki-crl-distribution-point-matching-bypass)
- [rustls-webpki name constraint bypass for wildcard certificates](https://junglewise.ai/threats/cve-2026-93601-rustls-webpki-name-constraint-bypass-for-wildcard-certificates)
- [rustls-webpki X.509 name constraint bypass for URI names](https://junglewise.ai/threats/cve-2026-93600-rustls-webpki-x-509-name-constraint-bypass-for-uri-names)
- [rustls-webpki integer underflow in BIT STRING parsing](https://junglewise.ai/threats/cve-2026-93599-rustls-webpki-integer-underflow-in-bit-string-parsing)