Name constraints were accepted for certificates asserting a wildcard name
Details
Package
rustls-webpki
Version
0.102.8
Date
2026-04-14
Patched versions
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint.
This is very similar to CVE-2025-61727.
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
> Name constraints were accepted for certificates asserting a wildcard name
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls-webpki` |
| Version | `0.102.8` |
| Date | 2026-04-14 |
| Patched versions | `>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6` |
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to [@1seal](https://github.com/1seal) for the report.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0099.html) for additional details.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
rustls-webpki0.102.8>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of
accept.example.com,*.example.comcould feasibly allow a name ofreject.example.comwhich is outside the constraint.This is very similar to CVE-2025-61727.
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.
See advisory page for additional details.