CVE-2026-93601: rustls-webpki Information Disclosure Flaw

CVE-2026-93601 Overview

CVE-2026-93601 affects rustls-webpki, the Rust WebPKI fork used by the rustls TLS library. Versions from 0.101.0 up to (but not including) 0.103.12 and 0.104.0-alpha.6 incorrectly evaluated permitted-subtree DNS name constraints against wildcard certificates. A permitted subtree such as accept.example.com was treated as satisfied by a certificate asserting *.example.com, even though that wildcard could match names outside the permitted subtree, such as reject.example.com. The flaw sits in X.509 certificate validation logic and is categorized as improper certificate validation [CWE-295].

Critical Impact
An attacker holding a misissued wildcard certificate could bypass name-constraint restrictions and present a certificate for a name outside the permitted subtree, undermining trust boundaries enforced by name constraints.

Affected Products

rustls-webpki versions >= 0.101.0 and < 0.103.12
rustls-webpki version 0.104.0-alpha.6
rustls-based TLS clients and servers that rely on name-constraint enforcement

Discovery Timeline

2026-09-18 - CVE-2026-93601 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93601

Vulnerability Analysis

X.509 name constraints let a certificate authority restrict which DNS names a subordinate CA may issue certificates for. The rustls-webpki verifier evaluates these constraints after signature validation succeeds. In affected versions, the permitted-subtree check accepted a wildcard subject name as long as the wildcard's parent domain matched the constraint label, without confirming the wildcard could not expand to names outside the permitted subtree.

Because the check is reached only after certificate chain signature verification, exploitation requires a misissued wildcard certificate from a CA that a relying party trusts either directly or through a name-constrained intermediate. This limits the practical attack surface but does not eliminate the risk in multi-tenant PKI environments where name constraints are the primary tenant boundary.

Root Cause

The permitted-subtree comparison logic in rustls-webpki treated a wildcard subject such as *.example.com as satisfying a constraint of accept.example.com. The correct behavior is to reject any wildcard whose expansion set includes names not covered by the permitted subtree. The fix, shipped in 0.103.12 and 0.104.0-alpha.6, tightens the comparison so wildcards must be fully contained within the permitted subtree.

Attack Vector

An attacker must obtain a misissued wildcard certificate signed by a CA the victim trusts. The attacker then presents that certificate during a TLS handshake for a hostname outside the permitted subtree that the name-constrained intermediate should have blocked. A verifier running an affected rustls-webpki version accepts the chain, allowing the attacker to impersonate a service on a name the CA was not authorized to issue.

The issue described in the GitHub Security Advisory GHSA-xgp8-3hg3-c2mh requires network access and a valid, though misissued, certificate. No code example is warranted because exploitation is a configuration and PKI-trust scenario rather than a memory or logic bug reachable through crafted input alone.

Detection Methods for CVE-2026-93601

Indicators of Compromise

TLS handshakes presenting wildcard certificates for hostnames that should fall outside a name-constrained intermediate's permitted subtree.
Certificate chains where a subordinate CA with nameConstraints issues wildcard leaf certificates whose expansion crosses subtree boundaries.
Anomalous certificate acceptance logs from rustls-based services running vulnerable rustls-webpki versions.

Detection Strategies

Inventory Rust binaries and services and identify those linking rustls-webpki versions between 0.101.0 and 0.103.11, or 0.104.0-alpha.6.
Perform passive TLS monitoring to log presented certificates, wildcard subjects, and issuing intermediates for review against expected name-constraint policy.
Compare observed leaf certificate subjects against the nameConstraints extension of their signing intermediate to flag mismatches.

Monitoring Recommendations

Enable Certificate Transparency log monitoring for domains protected by name-constrained intermediates.
Alert on any wildcard certificate issued by a CA subject to name constraints when the wildcard could expand outside the permitted subtree.
Continuously scan dependency manifests such as Cargo.lock for rustls-webpki versions in the affected range.

How to Mitigate CVE-2026-93601

Immediate Actions Required

Upgrade rustls-webpki to 0.103.12 or, for pre-release consumers, to 0.104.0-alpha.6 or later.
Rebuild and redeploy all Rust services, CLI tools, and libraries that statically link rustls-webpki.
Audit trust stores and remove or reissue any intermediates whose name constraints have been relied on as a hard security boundary.

Patch Information

The maintainers released fixed versions 0.103.12 and 0.104.0-alpha.6 addressing the permitted-subtree wildcard handling. Refer to the GitHub Security Advisory GHSA-xgp8-3hg3-c2mh and the VulnCheck Advisory for Rustls WebPKI for version details and upstream commits. Update transitive dependencies by refreshing Cargo.lock and rebuilding release artifacts.

Workarounds

If patching is not immediately possible, remove trust in intermediates that rely on name constraints as a tenant boundary.
Enforce hostname allow-lists at the application layer to reject unexpected wildcard subjects independent of the WebPKI verifier.
Where feasible, pin expected leaf certificates or SPKI hashes for critical endpoints to bypass reliance on name-constraint evaluation.

bash

# Configuration example: upgrade rustls-webpki in a Rust project
cargo update -p rustls-webpki --precise 0.103.12
cargo build --release