rustls webpki Name Constraints URI Validation Bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-93600 · CVE overview and exploitation status

EUVD-2026-82895

GHSA-fr4g-m728-g2mf

GHSA-965h-392x-2mh5

RUSTSEC-2026-0098

cve-program · CVE-2026-93600

• https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5
• https://www.vulncheck.com/advisories/rustls-webpki-name-constraints-uri-validation-bypass

euvd · EUVD-2026-82895

• https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5
• https://www.vulncheck.com/advisories/rustls-webpki-name-constraints-uri-validation-bypass

nvd · CVE-2026-93600

• https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5
• https://www.vulncheck.com/advisories/rustls-webpki-name-constraints-uri-validation-bypass

osv · GHSA-965h-392x-2mh5

• https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5
• https://github.com/rustls/webpki
• https://rustsec.org/advisories/RUSTSEC-2026-0098.html

osv · RUSTSEC-2026-0098

• https://crates.io/crates/rustls-webpki
• https://rustsec.org/advisories/RUSTSEC-2026-0098.html

• rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because n… · Advisory content revised · 5 Nov 2026
• rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because n… · Advisory content revised · 1 Nov 2026