Approved changes feed: RSS · Atom
cpe:2.3:a:rustls:webpki:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Rustls (591d41d2-b260-5ae6-87b6-c70092a59145) |
|---|---|
| Product | Webpki (31331dbe-60f5-58f5-9bbb-f79b0583d8c2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-93600 |
vulnerable | 2026-10-13 12:28:56.086433 |
rustls webpki Name Constraints URI Validation Bypass
LOW (2.2)
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.
Published: 2026-09-18T13:20:10.899Z
Updated: 2026-09-21T20:51:59.078Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93602 |
vulnerable | 2026-10-13 12:28:55.989537 |
rustls-webpki before 0.103.10 CRL Revocation Check Bypass
MEDIUM (4.4)
rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.
Published: 2026-09-18T13:20:12.259Z
Updated: 2026-09-18T17:58:12.511Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.