{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xgp8-3hg3-c2mh/GHSA-xgp8-3hg3-c2mh.json"},"package":{"ecosystem":"crates.io","name":"rustls-webpki","purl":"pkg:cargo/rustls-webpki"},"ranges":[{"events":[{"introduced":"0.101.0"},{"fixed":"0.103.12"}],"type":"SEMVER"}]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xgp8-3hg3-c2mh/GHSA-xgp8-3hg3-c2mh.json"},"package":{"ecosystem":"crates.io","name":"rustls-webpki","purl":"pkg:cargo/rustls-webpki"},"ranges":[{"events":[{"introduced":"0.104.0-alpha.1"},{"fixed":"0.104.0-alpha.6"}],"type":"SEMVER"}]}],"aliases":["CVE-2026-93601","RUSTSEC-2026-0099"],"database_specific":{"cwe_ids":["CWE-295"],"github_reviewed":true,"github_reviewed_at":"2026-04-16T21:17:12Z","nvd_published_at":null,"severity":"LOW"},"details":"Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.\n\nThis was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.\nThis is very similar to [CVE-2025-61727](https://go.dev/issue/76442).\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.","id":"GHSA-xgp8-3hg3-c2mh","modified":"2026-09-19T03:55:49.146112754Z","published":"2026-04-16T21:17:12Z","references":[{"type":"WEB","url":"https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh"},{"type":"PACKAGE","url":"https://github.com/rustls/webpki"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0099.html"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","type":"CVSS_V3"}],"summary":"webpki: Name constraints were accepted for certificates asserting a wildcard name"}