CVE-2026-93600 affecting package rust 1.75.0-31
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.
AZL-103496
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:AZL-103496
rust
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.75.0-31"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:rpm/azure-linux/rust",
"ecosystem": "Azure Linux:3"
},
"database_specific": {
"source": "https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103496.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #21171 · Revision 1
- Added to Heist Feed
- Publisher date