{"answers":{"affected":"1 open source package ship an affected version, including x509-validator.","exploited":"There is no known exploitation of RUSTSEC-2026-0312 in the wild and no public exploit code.","fix":"Upgrade x509-validator to 0.3.1 or later.","what":"RUSTSEC-2026-0312 is a vulnerability in x509-validator, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0312 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0312 is a vulnerability in x509-validator, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of RUSTSEC-2026-0312 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- x509-validator (crates.io): affected from 0.0.0-0; fixed in 0.3.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0312/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0312/index.md)","id":"RUSTSEC-2026-0312","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0312/index.md","name":"RUSTSEC-2026-0312","record":{"aliases":["GHSA-39mm-4q6x-3vrx"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust X.509 validator","requires_auth":"high_privilege","summary":"Attackers with compromised sub-CA keys can issue valid certificates for arbitrary IP addresses, bypassing name constraints in the x509-validator library.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"An `excluded_subtrees` iPAddress name constraint with an all-zero mask\n(`0.0.0.0/0` or `::/0`) does not restrict iPAddress SANs in certificates issued\nbeneath it. The mask check treated an all-zero mask as matching nothing, when a\n`/0` prefix matches every address of its family, so the exclusion was silently\nignored.\n\nCA/Browser Forum Baseline Requirements §7.1.2.5.2 require exactly these\nexclusions on every technically constrained sub-CA that may not issue for IP\naddresses. As a result, anyone holding (or having compromised) the key of such\na sub-CA can issue a certificate for an arbitrary IP address, and `Validator`\nwith `RFC5280Policy` and `ServerIdentityPolicy` accepts it for that address. A\n`permitted_subtrees` dNSName entry on the same issuer does not prevent this,\nbecause iPAddress SANs are a different name form.\n\nAll users of `Validator` with `RFC5280Policy` are affected when a chain can\ncontain a name-constrained issuer with an all-zero iPAddress exclusion.\n\nThe issue is fixed in x509-validator 0.3.1 (commit\n[da661f8](https://github.com/namecare/x509-validator/commit/da661f8ecee820e05d089a76ecb654ff52a2c987)).\nUsers should upgrade to 0.3.1 or later.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Excluded iPAddress name constraints with an all-zero mask are not applied","id":"RUSTSEC-2026-0312","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.3.1"],"introduced":["0.0.0-0"],"last_affected":[],"package":"x509-validator","purl":"pkg:cargo/x509-validator","source":"RUSTSEC-2026-0312"}],"products":null,"published":"2026-09-24","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers with compromised sub-CA keys can issue valid certificates for arbitrary IP addresses, bypassing name constraints in the x509-validator library.","url":"https://insights.sbomify.com/RUSTSEC-2026-0312/"}