Name Constraint Bypass in rustls-webpki Affects Multiple Versions

CVE-2026-93601

What is CVE-2026-93601?

The rustls-webpki version range from 0.101.0 to 0.103.12, along with version 0.104.0-alpha.6, contains a critical issue where DNS name constraints for wildcard certificates are incorrectly validated. Under specific conditions, a permitted-subtree constraint can be exploited due to accepting wildcard names. For instance, a name constraint such as 'accept.example.com' may erroneously permit a wildcard certificate '* .example.com', which could correspond to domains outside the defined permitted subtree, such as 'reject.example.com'. This vulnerability arises only after successful signature verification and necessitates a misissued wildcard certificate to be exploitable.

References