CVE-2026-93601
CVE-2026-93601
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.2 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Weakness classification (CWE)
References
- github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh (vendor-advisory)
- www.vulncheck.com/advisories/rustls-webpki-0.101.0-before-0.103.12-name-constra… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-93601?
- CVE-2026-93601 is a low-severity vulnerability, classified under Improper Certificate Validation. CVSS score: 2.2/10. Published 2026-09-18.
- How severe is CVE-2026-93601?
- Low severity. CVSS v3 base score is 2.2 out of 10.