CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

What is CVE-2026-93601?

CVE-2026-93601 is a low-severity vulnerability in rustls webpki, published on 18 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Weakness: CWE-295

Which versions are affected by CVE-2026-93601?

5 open source packages ship an affected version, including rustls-webpki.

How do I fix CVE-2026-93601?

Upgrade rustls-webpki to a fixed version for your release line: 0.103.12 or 0.104.0-alpha.6.

Is CVE-2026-93601 being exploited?

There is no known exploitation of CVE-2026-93601 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as AZL-103460, AZL-103500, AZL-103509, AZL-103521, CLEANSTART-2026-PO20048, DEBIAN-CVE-2026-93601 and 28 more.