RUSTSEC-2026-0312 Excluded iPAddress name constraints with an all-zero mask are not applied
Attackers with compromised sub-CA keys can issue valid certificates for arbitrary IP addresses, bypassing name constraints in the x509-validator library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0312?
RUSTSEC-2026-0312 is a vulnerability in x509-validator, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An excluded_subtrees iPAddress name constraint with an all-zero mask
(0.0.0.0/0 or ::/0) does not restrict iPAddress SANs in certificates issued
beneath it. The mask check treated an all-zero mask as matching nothing, when a
/0 prefix matches every address of its family, so the exclusion was silently
ignored.
CA/Browser Forum Baseline Requirements §7.1.2.5.2 require exactly these
exclusions on every technically constrained sub-CA that may not issue for IP
addresses. As a result, anyone holding (or having compromised) the key of such
a sub-CA can issue a certificate for an arbitrary IP address, and Validator
with RFC5280Policy and ServerIdentityPolicy accepts it for that address. A
permitted_subtrees dNSName entry on the same issuer does not prevent this,
because iPAddress SANs are a different name form.
All users of Validator with RFC5280Policy are affected when a chain can
contain a name-constrained issuer with an all-zero iPAddress exclusion.
The issue is fixed in x509-validator 0.3.1 (commit da661f8). Users should upgrade to 0.3.1 or later.
Which versions are affected by RUSTSEC-2026-0312?
1 open source package ship an affected version, including x509-validator.
| Package | Affected | Fixed in |
|---|---|---|
x509-validator crates.io | From 0.0.0-0 | 0.3.1 |
How do I fix RUSTSEC-2026-0312?
Upgrade x509-validator to 0.3.1 or later.
Is RUSTSEC-2026-0312 being exploited?
There is no known exploitation of RUSTSEC-2026-0312 in the wild and no public exploit code.
Sources
Also known as GHSA-39mm-4q6x-3vrx.