RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.2k
- Forks
- 232
- Avg merge
- 11h 35m
- Merged PRs (30d)
- 60
Description
Name constraints were accepted for certificates asserting a wildcard name
| Details | |
|---|---|
| Package | rustls-webpki |
| Version | 0.103.11 |
| Date | 2026-04-14 |
| Patched versions | >=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6 |
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint.
This is very similar to CVE-2025-61727.
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.
See advisory page for additional details.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by determining how docs.rs handles RustSec advisories for the rustls-webpki package and whether this repository is expected to change; done means the required security issue is addressed or its handling is documented and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100