{"cve":"CVE-2026-93600","nvd":{"published":"2026-09-18T14:19:11.563","modified":"2026-09-22T20:25:55.870","status":"Awaiting Analysis","description":"rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","score":2.2},"cwes":["CWE-295"],"references":["https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5","https://www.vulncheck.com/advisories/rustls-webpki-name-constraints-uri-validation-bypass"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-93600","score":0.00203,"percentile":0.10301,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-965h-392x-2mh5","url":"https://osv.dev/vulnerability/GHSA-965h-392x-2mh5","summary":"webpki: Name constraints for URI names were incorrectly accepted","modified":"2026-09-19T03:55:32.245575348Z","packages":[{"ecosystem":"crates.io","name":"rustls-webpki","purl":"pkg:cargo/rustls-webpki","ranges":[">=0.101.0 <0.103.12"],"fixed":["0.103.12"]},{"ecosystem":"crates.io","name":"rustls-webpki","purl":"pkg:cargo/rustls-webpki","ranges":[">=0.104.0-alpha.1 <0.104.0-alpha.6"],"fixed":["0.104.0-alpha.6"]}]},{"id":"RUSTSEC-2026-0098","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0098","summary":"Name constraints for URI names were incorrectly accepted","modified":"2026-09-19T08:42:27Z","packages":[{"ecosystem":"crates.io","name":"rustls-webpki","purl":"pkg:cargo/rustls-webpki","ranges":[">=0.0.0-0 <0.103.12",">=0.104.0-alpha.1 <0.104.0-alpha.6"],"fixed":["0.103.12","0.104.0-alpha.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}