# rustls-webpki (crates.io) vulnerabilities

5 known vulnerabilities (1 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 0.103.16 (Oct 20, 2026): no advisory affects it
- Newest unaffected release: 0.103.16 (Oct 20, 2026), the latest release
- Weekly downloads: 19.4M
- Dependents: 1
- Releases: 58 since 0.100.0 (Mar 13, 2023)
- Registry: https://crates.io/crates/rustls-webpki
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-111943: 0.0.0-invalid to 0.103.15 (0.103.16 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.7 (0.104.0-alpha.8 is outside it)
- CVE-2026-93602: 0.102.0-alpha.0 to 0.103.9 (0.103.10 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.4 (0.104.0-alpha.5 is outside it)
- CVE-2026-93601: 0.0.0-invalid to 0.103.11 (0.103.12 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.5 (0.104.0-alpha.6 is outside it)
- CVE-2026-93600: 0.0.0-invalid to 0.103.11 (0.103.12 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.5 (0.104.0-alpha.6 is outside it)
- CVE-2026-93599: 0.0.0-invalid to 0.103.12 (0.103.13 is outside it); 0.104.0-alpha.1 to 0.104.0-alpha.6 (0.104.0-alpha.7 is outside it)

## Advisories (5)

### [CVE-2026-111943](https://cve.now/CVE-2026-111943): Distrust compromised intermediate certificates in crypto/x509

- Severity: Medium 6.8
- Published: Oct 21, 2026
- Affected: fixed in 0.103.16; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.8.
- Fixed in 0.103.16 (released Oct 20, 2026, 1 day before disclosure) and 0.104.0-alpha.8 (released Oct 20, 2026, 1 day before disclosure).
- The latest release, 0.103.16, is not affected.

### [CVE-2026-93602](https://cve.now/CVE-2026-93602): rustls-webpki before 0.103.10 CRL Revocation Check Bypass

- Severity: Medium 5.9
- Published: Sep 18, 2026
- Affected: from 0.102.0-alpha.0, fixed in 0.103.10; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.5.
- Fixed in 0.103.10 (released Mar 20, 2026, 182 days before disclosure) and 0.104.0-alpha.5 (released Mar 20, 2026, 182 days before disclosure).
- The latest release, 0.103.16, is not affected.

### [CVE-2026-93601](https://cve.now/CVE-2026-93601): rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

- Severity: Low 2.1
- Published: Sep 18, 2026
- Affected: fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6; from 0.101.0, fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6.
- Fixed in 0.103.12 (released Apr 14, 2026, 157 days before disclosure) and 0.104.0-alpha.6 (released Apr 13, 2026, 158 days before disclosure).
- The latest release, 0.103.16, is not affected.

### [CVE-2026-93600](https://cve.now/CVE-2026-93600): rustls webpki Name Constraints URI Validation Bypass

- Severity: Low 2.1
- Published: Sep 18, 2026
- Affected: from 0.101.0, fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6; fixed in 0.103.12; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.6.
- Fixed in 0.103.12 (released Apr 14, 2026, 157 days before disclosure) and 0.104.0-alpha.6 (released Apr 13, 2026, 158 days before disclosure).
- The latest release, 0.103.16, is not affected.

### [CVE-2026-93599](https://cve.now/CVE-2026-93599): rustls-webpki before 0.103.13 Panic via empty BIT STRING

- Severity: High 8.7
- Published: Sep 18, 2026
- Affected: fixed in 0.103.13; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.7; fixed in 0.103.13; from 0.104.0-alpha.1, fixed in 0.104.0-alpha.7.
- Fixed in 0.103.13 (released Apr 21, 2026, 150 days before disclosure) and 0.104.0-alpha.7 (released Apr 21, 2026, 150 days before disclosure).
- The latest release, 0.103.16, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io/rustls-webpki
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.