CVE-2026-93600: rustls webpki Name Constraints URI Validation Bypass
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rustls-webpki (rustls/webpki)to a version that resolves this vulnerability.Fixed in 0.104.0-alpha.6 - Upgrade
Upgrade
rustls-webpki (rustls/webpki)to a version that resolves this vulnerability.Fixed in 0.103.12
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using rustls-webpki 0.101.0 through 0.103.11, or 0.104.0-alpha releases before 0.104.0-alpha.6, may be exposed when certificate validation encounters X.509 URI name constraints. Exploitation also depends on a misissued certificate with otherwise successful signature verification.
What does an attacker need for exploitation?
An attacker needs a misissued certificate that passes signature verification and relies on URI name constraints that should have restricted that certificate. A validly signed certificate by itself is not sufficient unless the relevant URI name-constraint condition is present.
How can I determine whether the installed library version is affected?
Versions 0.101.0 through 0.103.11 are affected, as are 0.104.0-alpha versions earlier than 0.104.0-alpha.6. Version 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.
What should be done if URI name constraints are encountered?
Upgrade to 0.103.12 or 0.104.0-alpha.6, where URI name constraints are rejected unconditionally. The library provides no API for asserting URI names, and URI name constraints are otherwise unimplemented.