CVE-2026-93600: rustls-webpki X.509 Name Constraint Bypass

CVE-2026-93600 Overview

CVE-2026-93600 affects rustls-webpki, the X.509 certificate validation library used by the rustls TLS stack. Versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints applied to Uniform Resource Identifier (URI) names. The library accepts such constraints rather than enforcing them. The flaw is only reachable after successful signature verification and requires a misissued certificate. The library exposes no API for asserting URI names, and URI name constraints are otherwise unimplemented [CWE-295].

Critical Impact
A misissued certificate containing URI Subject Alternative Names could bypass name constraint restrictions intended to limit a subordinate Certificate Authority's issuance scope.

Affected Products

rustls-webpki versions 0.101.0 through 0.103.11
rustls-webpki0.104.0-alpha releases before 0.104.0-alpha.6
Applications using rustls for TLS certificate validation via affected webpki versions

Discovery Timeline

2026-09-18 - CVE-2026-93600 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93600

Vulnerability Analysis

The vulnerability is an improper certificate validation issue in the name constraints processing logic of rustls-webpki. X.509 name constraints, defined in RFC 5280, allow a Certificate Authority (CA) to restrict the namespaces within which subordinate CAs may issue certificates. Constraint types include DNS names, IP addresses, email addresses, directory names, and URIs.

The affected versions parse URI name constraints but fail to enforce them during path validation. A certificate chain containing a subordinate CA restricted to a specific URI namespace could issue leaf certificates with URI Subject Alternative Names outside the constrained scope. The library treats these constraints as satisfied without performing the required comparison.

Exploitation requires an attacker to obtain a misissued certificate from a CA whose namespace should have been restricted by URI constraints. Because rustls-webpki provides no API for callers to assert URI names during verification, the practical exploitation surface is limited. The issue matters most for certificate chain validation semantics rather than direct application-visible identity checks.

Root Cause

The root cause is missing enforcement logic for the uniformResourceIdentifier constraint type in the name constraints extension handler. The parser accepts URI-typed general names in the constraint set but the validator does not compare them against the corresponding names in subordinate certificates.

Attack Vector

The attack requires a valid, signed certificate chain in which a constrained intermediate CA issues a certificate that violates a URI name constraint. The chain must pass signature verification first. The attacker must control or obtain such a misissued certificate, which raises the difficulty threshold considerably. Refer to the GitHub Security Advisory and VulnCheck Advisory for the full technical description.

Detection Methods for CVE-2026-93600

Indicators of Compromise

Presence of rustls-webpki versions 0.101.0 through 0.103.11 in dependency manifests such as Cargo.lock
TLS handshakes accepting leaf certificates whose URI Subject Alternative Names fall outside the URI namespace declared in an intermediate CA's name constraints extension
Unexpected certificate issuance events from constrained subordinate CAs in Certificate Transparency logs

Detection Strategies

Inventory all Rust projects and produced binaries for the rustls-webpki crate version using software composition analysis tools
Audit certificate chains presented in production TLS traffic for URI name constraint violations using an external validator that enforces the constraint
Monitor Certificate Transparency feeds for certificates issued by internal or partner CAs that should be scoped by URI constraints

Monitoring Recommendations

Track dependency graphs for transitive inclusion of vulnerable rustls-webpki versions in first-party and vendor software
Log full certificate chains at TLS termination points to enable retrospective validation against name constraint policy
Alert on new subordinate CA certificates that include URI name constraint extensions to confirm downstream libraries enforce them

How to Mitigate CVE-2026-93600

Immediate Actions Required

Upgrade rustls-webpki to version 0.103.12 or 0.104.0-alpha.6, both of which reject URI name constraints unconditionally
Rebuild and redeploy any Rust binaries that statically link the affected crate versions
Review PKI trust stores to identify any intermediate CAs relying on URI name constraints for issuance scoping

Patch Information

The rustls project released fixed versions 0.103.12 and 0.104.0-alpha.6. These releases reject URI name constraints unconditionally rather than silently accepting them, closing the enforcement gap. Consult the GitHub Security Advisory GHSA-965h-392x-2mh5 for the full changeset and version guidance.

Workarounds

Avoid issuing intermediate CA certificates that rely solely on URI name constraints to restrict subordinate issuance scope
Enforce name constraints out-of-band using an external certificate validator until affected consumers are upgraded
Restrict trust anchors to CAs whose issuance policies do not require URI-based namespace segmentation

bash

# Update the vulnerable crate in a Rust project
cargo update -p rustls-webpki --precise 0.103.12
cargo tree -i rustls-webpki
cargo build --release