https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:03:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93601 <p>rustls-webpki (the Rust webpki fork used by rustls) versions &gt;= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.</p> <p>rustls-webpki (the Rust webpki fork used by rustls) versions &gt;= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-93601 https://vulnerability.circl.lu/vuln/ghsa-27hx-xqx9-p6hq <p>rustls-webpki (the Rust webpki fork used by rustls) versions &gt;= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.</p> <p>rustls-webpki (the Rust webpki fork used by rustls) versions &gt;= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.</p> https://vulnerability.circl.lu/vuln/ghsa-27hx-xqx9-p6hq https://vulnerability.circl.lu/vuln/msrc_cve-2026-93601 msrc_CVE-2026-93601 https://vulnerability.circl.lu/vuln/msrc_cve-2026-93601 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11936-1 <p>python313-tokenizers-0.23.2-1.1 on GA media</p> <p>python313-tokenizers-0.23.2-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11936-1 https://vulnerability.circl.lu/vuln/rustsec-2026-0099 <p><strong>Affected:</strong> crates.io: rustls-webpki</p> <p>Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.</p> <p>This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint. This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).</p> <p>Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.</p> <p>This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to [@1seal](https://github.com/1seal) for the report.</p> <p><strong>Affected:</strong> crates.io: rustls-webpki</p> <p>Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.</p> <p>This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint. This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).</p> <p>Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.</p> <p>This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to [@1seal](https://github.com/1seal) for the report.</p> https://vulnerability.circl.lu/vuln/rustsec-2026-0099 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93601 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-rustls-webpki, Ubuntu:26.04:LTS: rust-rustls-webpki</p> <p>rustls-webpki (the Rust webpki fork used by rustls) versions &gt;= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-rustls-webpki, Ubuntu:26.04:LTS: rust-rustls-webpki</p> <p>rustls-webpki (the Rust webpki fork used by rustls) versions &gt;= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93601