Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys when the configured trust anchors allow such paths.
The private keys corresponding to these intermediates are now well known.
Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.
> Certificate verification may accept distrusted intermediates
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls-webpki` |
| Version | `0.103.15` |
| URL | [https://github.com/rustls/webpki/pull/546](https://github.com/rustls/webpki/pull/546) |
| Date | 2026-10-20 |
| Patched versions | `>=0.103.16, <0.104.0-alpha.1,>=0.104.0-alpha.8` |
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys when the configured trust anchors allow such paths.
The private keys corresponding to these intermediates are now well known.
Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0382.html) for additional details.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
rustls-webpki0.103.15>=0.103.16, <0.104.0-alpha.1,>=0.104.0-alpha.8Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys when the configured trust anchors allow such paths.
The private keys corresponding to these intermediates are now well known.
Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.
See advisory page for additional details.