RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted

| Details | |
| --- | --- |
| Package | `rustls-webpki` |
| Version | `0.101.7` |
| URL | n/a |
| Patched Versions | >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 |
| Aliases | [GHSA-965h-392x-2mh5](https://github.com/advisories/GHSA-965h-392x-2mh5) |

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to [@1seal](https://github.com/1seal) for the report.

Examinez la manière dont le dépôt déclare la dépendance rustls-webpki et comparez sa version avec les versions corrigées répertoriées dans cette issue. Commencez par vérifier les métadonnées de la dépendance et les tests de validation existants ; le travail est terminé lorsque la version vulnérable 0.101.7 n’est plus sélectionnée et que les vérifications pertinentes réussissent.

Rédigé par le modèle d'indexation à partir du texte de l'issue.