URI Name Constraint Bypass in rustls-webpki by Cloudflare
CVE-2026-93600

2.1LOW

Key Information:

Vendor

Rustls

Status
Webpki
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93600?

The rustls-webpki library, utilized by Cloudflare, has a vulnerability where it fails to enforce X.509 name constraints for URI names across specific versions. This oversight permits the acceptance of misissued certificates after a successful signature verification, potentially compromising the integrity of secure communications. Although the flaw necessitates a misissued certificate, the absence of API support for asserting URI names amplifies the risk. Updated versions have addressed this limitation by ensuring unsanctioned URI name constraints are immediately rejected.

Affected Version(s)

webpki 0.101.0 < 0.103.12

webpki 0.104.0-alpha.1 < 0.104.0-alpha.6

References

https://github.com/rustls/webpki/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/rustls-webpki-name-c...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

1seal
.