Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

rustls-webpki

5 known vulnerabilities (1 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
0.103.16 (Oct 20, 2026): no advisory affects it
Newest unaffected release
0.103.16 (Oct 20, 2026), the latest release
Advisories
5 · 1 high, 2 medium, 2 low
Weekly downloads
19.4M
Dependents
1
Releases
58 since 0.100.0 (Mar 13, 2023)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-111943
    Affects 0.0.0-invalid to 0.103.15 (0.103.16 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.7 (0.104.0-alpha.8 is outside it)
  • CVE-2026-93602
    Affects 0.102.0-alpha.0 to 0.103.9 (0.103.10 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.4 (0.104.0-alpha.5 is outside it)
  • CVE-2026-93601
    Affects 0.0.0-invalid to 0.103.11 (0.103.12 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.5 (0.104.0-alpha.6 is outside it)
  • CVE-2026-93600
    Affects 0.0.0-invalid to 0.103.11 (0.103.12 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.5 (0.104.0-alpha.6 is outside it)
  • CVE-2026-93599
    Affects 0.0.0-invalid to 0.103.12 (0.103.13 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.6 (0.104.0-alpha.7 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-111943Medium 6.8

    Distrust compromised intermediate certificates in crypto/x509

    Affected: fixed in 0.103.16; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.8.

    Fixed in 0.103.16 (released Oct 20, 2026, 1 day before disclosure) and 0.104.0-alpha.8 (released Oct 20, 2026, 1 day before disclosure).

    The latest release, 0.103.16, is not affected.

  • CVE-2026-93602Medium 5.9

    rustls-webpki before 0.103.10 CRL Revocation Check Bypass

    Affected: from 0.102.0-alpha.0, fixed in 0.103.10; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.5.

    Fixed in 0.103.10 (released Mar 20, 2026, 182 days before disclosure) and 0.104.0-alpha.5 (released Mar 20, 2026, 182 days before disclosure).

    The latest release, 0.103.16, is not affected.

  • rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

    Affected: fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6; from 0.101.0, fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6.

    Fixed in 0.103.12 (released Apr 14, 2026, 157 days before disclosure) and 0.104.0-alpha.6 (released Apr 13, 2026, 158 days before disclosure).

    The latest release, 0.103.16, is not affected.

  • rustls webpki Name Constraints URI Validation Bypass

    Affected: from 0.101.0, fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6; fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6.

    Fixed in 0.103.12 (released Apr 14, 2026, 157 days before disclosure) and 0.104.0-alpha.6 (released Apr 13, 2026, 158 days before disclosure).

    The latest release, 0.103.16, is not affected.

  • rustls-webpki before 0.103.13 Panic via empty BIT STRING

    Affected: fixed in 0.103.13; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.7; fixed in 0.103.13; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.7.

    Fixed in 0.103.13 (released Apr 21, 2026, 150 days before disclosure) and 0.104.0-alpha.7 (released Apr 21, 2026, 150 days before disclosure).

    The latest release, 0.103.16, is not affected.