Every CVE Search/ Get API key

CVE-2026-93601

rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

2.1 LowFix available

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.20%Unchanged since Sep 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.1

rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
CVE-2026-93601
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2026-82896 2.1

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
EUVD-2026-82896
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-27hx-xqx9-p6hq 2.1

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and...

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
GHSA-27hx-xqx9-p6hq
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
GitHub AdvisoriesGHSA-xgp8-3hg3-c2mh 2.2

webpki: Name constraints were accepted for certificates asserting a wildcard name

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

Record
GHSA-xgp8-3hg3-c2mh
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 2.1

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
CVE-2026-93601
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 2.1

rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
CVE-2026-93601
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-295
Updated
2026-11-04
Show 18 moreShow less
OSVDEBIAN-CVE-2026-93601 2.1

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
DEBIAN-CVE-2026-93601
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-xgp8-3hg3-c2mh 2.2

webpki: Name constraints were accepted for certificates asserting a wildcard name

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

Record
GHSA-xgp8-3hg3-c2mh
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVUBUNTU-CVE-2026-93601 2.1

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
UBUNTU-CVE-2026-93601
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-103460 No score

CVE-2026-93601 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
AZL-103460
Updated
2026-11-05
OSVAZL-103500 No score

CVE-2026-93601 affecting package rust 1.75.0-31

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
AZL-103500
Updated
2026-11-02
OSVAZL-103509 No score

CVE-2026-93601 affecting package rust 1.98.1-1

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
AZL-103509
Updated
2026-11-05
OSVAZL-103521 No score

CVE-2026-93601 affecting package rust-afterburn 5.8.2-2

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.

Record
AZL-103521
Updated
2026-11-02
OSVopenSUSE-RU-2026:22132-1 No score

Recommended update for sequoia-sq

This update for sequoia-sq fixes the following issues:

Changes in sequoia-sq:

  • Use crypto-openssl also for tests

Update to version 1.5.0:

  • tool: Release v1.5.0.
  • tool: Fix link to README.
  • tool: Set a version for the sqz dependency.
  • Enable optimizations when building rust-crypto crates.
  • Update NEWS.
  • lib: Release v0.1.0.
  • Update Cargo.lock.
  • meta: Update link to documentation.
  • lib: Update README.
  • lib: Rename the high-level library to sqz.
  • lib: Fix documentation.
  • lib: Mention network_search in the lookup functions documentation.
  • lib: Mention lookup and lookup_by in the certify documentation.
  • lib: Mention lookup_by sign documentation.
  • lib: Document that calls don't need to specify secret key material.
  • lib: Fix docs.rs URL
  • meta: Add rustfmt.toml that disables formatting
  • lib: fix type infer error
  • lib: Pass Paths through as is.
  • lib: Preprocess the network when listing all bindings.
  • lib: Upgrade sequoia-wot.
  • lib: After running cert list, save the signature verification cache.
  • lib: Parallelize cert list.
  • lib: Pass the policy when getting the trust root or a shadow CA.
  • implement dumping of pqc artifacts
  • lib: Use an iterator instead of a slice.
  • lib: Avoid monomorphization in signer.
  • lib: Fix documentation.
  • tool: Fix documentation.
  • lib: Drop unnecessary imports in example.
  • lib: Add required clap features.
  • lib: Gate network support behind a feature.
  • Don't conflate inline and cleartext signatures.
  • lib: Document the signer module.
  • lib: Add unit tests to the signer module.
  • lib: Fix get_primary_keys's return type.
  • lib: Convert get_signing_key, etc. to use the builder pattern.
  • lib: Move decrypt_key to its own module.
  • lib: Rename keys module to signer.
  • lib: Refactor get_keys and associated functions.
  • lib: Improve prompt's documentation.
  • lib: Add a default prompt to Sequoia, don't require a prompt.
  • lib: Loosen Sized constraint.
  • lib: Make Prompt and PromptFactory Send and Sync.
  • lib: Change SequoiaBuilder::builder to consume self.
  • lib: Use explicit lifetimes with Context and Check.
  • Use more precise lifetimes when referencing Sequoia and Sq.
  • Replace generic lifetime names with more precise identifiers.
  • tool: Fix password prompt.
  • lib: Add PromptFactory.
  • tool: Drop Sq::local_trust_root.
  • lib: Change Ca to wrap a Cert instead of an Arc<LazyCert>.
  • lib: Add functionality for looking up certificates by email address.
  • lib: Add cert::CertProblem::ParseError.
  • tool: Don't wrap Sequoia::lookup.
  • lib: Improve lookup's documentation.
  • lib: Rename lookup to lookup_all.
  • lib: Don't write lints to stderr.
  • lib: Change lookup to use its own error type.
  • lib: Fix how Binding::cert looks up a certificate.
  • lib: Add an option to lookup certificates by subkey.
  • lib: Rename lookup's keyflags parameter to key_capabilities.
  • lib: Drop lookup's unused or_by_primary parameter.
  • lib: Fix key flags matching bug in Sequoia::lookup.
  • tool: Improve displaying possibly revoked certificates.
  • lib: Change lookup to take a single key handle.
  • lib: Improve key generate's documentation.
  • lib: Add unit tests for key generate.
  • lib: Avoid monomorphization in key generate.
  • lib: Rename Artifact to Outcome.
  • lib: Use impl IntoIterator in setters.
  • lib: Drop duplicated code.
  • lib: Implement Clone for a few data structures.
  • lib: Mark UserIDLint as non-exhaustive.
  • lib: Implement Clone for UserIDLint.
  • lib: Implement IntoIterator for network::search::Query.
  • lib: Change network search to return an Outcome on success.
  • lib: Change function to take an IntoIterator instead of a Vec.
  • lib: Avoid monomorphization in the network search functionality.
  • lib: Implement Clone for a few data structures.
  • lib: Make Response and SourceInfo clonable.
  • lib: Change cert list to always emit a Report.
  • lib:…
Record
openSUSE-RU-2026:22132-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11936-1 No score

python313-tokenizers-0.23.2-1.1 on GA media

These are all security issues fixed in the python313-tokenizers-0.23.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11936-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21982-1 No score

Security update for sccache

This update for sccache fixes the following issues:

  • CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
  • CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
  • CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
  • CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
  • CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
  • CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
  • CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
  • CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
  • CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
  • CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
  • CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
  • CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
  • CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
  • CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
  • CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
  • CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
  • CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
  • CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
  • CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

  • Add experimental concurrent cache support
  • chore: Remove dependency status badge (#2856)
  • Don't hand the jobserver to children that can't use it
  • dist: refuse to trim rlibs from crates that also emit a cdylib
  • fix(cache): avoid duplicate multilevel reads
  • Strip basedirs from the compiler arguments too
  • tests/integration: replace MinIO with Silo
  • ci: dump sccache logs on integration failures
  • multilevel: a chain with any writable level is writable
  • Fix parsing of #line directives
  • Release 0.18.0
  • daemonize: use an allow-list approach to inherited FDs
  • gcc, clang: make the assembler part of the cache key
  • support cl.exe /openmp:llvm
  • support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
  • support MSVC /feature argument
  • msvc: support lots of flags (#2832)
  • Update shlex dependency to version 2 (#2836)
  • gcc: mark flags as TooHard if need to cache something else (#2833)
  • clang: support more CLI options (#2834)
  • msvc: support arm64EC and fastfail flags (#2830)
  • chore: fix typo in comment (#2829)
  • nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
  • cache: allow skipping capability checks (#2822)
  • Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
  • nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
  • Add an agent (#2812)
  • Add support for d20bforceinline. (#2807)
  • feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
  • Bump MSRV to 1.91.0 (#2793)
  • Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
  • test: Fixed…
Record
openSUSE-SU-2026:21982-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22016-1 No score

Security update for rustup

This update for rustup fixes the following issues:

  • CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
  • CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
  • CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
  • CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
  • CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
  • CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
  • CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
  • CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
  • CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
  • CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
  • CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
  • CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
  • CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
  • CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
  • CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
  • CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
  • rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

  • Update to version 1.29.1~0:
  • dist(rustup-init/sh): update commit shasum in help string
  • style(bin/rustup-init): reformat code
  • docs(changelog): update for v1.29.1 stable release
  • warn how to switch away from the deprecated complete profile
  • fix(cli/help): fix wording in rustup run --help
  • ci(docker/android): stop building OpenSSL
  • refactor(cli/docs): use tracing for docs opening status messages
  • refactor(self-update): rename Windows uninstall registry helpers
  • feat(test): isolate Windows registry state per test
  • docs(dev-guide): mention how to support new compilation targets
  • Fix funding link
  • chore(deps): lock file maintenance
  • refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
  • refactor(cli/self-update): move process out of InstallOpts
  • fix(cli/self-update): postpone initialization of Cfg in setup_mode
  • refactor(cli/self-update): take Process in check_existence_of_settings_file()
  • fix(settings): prevent creating new file with SettingsFile::read_settings()
  • test(cli-inst-interactive): test file creation on cancelled installation
  • refactor(toolchain/names): inline validate() aliases into FromStr
  • refactor(toolchain/names): rename validate() to normalize_name()
  • fix minor typos
  • www: align copy icon
  • refactor(toolchain/names)!: remove try_from_str!()
  • refactor(toolchain/names)!: remove from_variant!()
  • Add rustup doc --serve to serve docs over local HTTP
  • Move doc() and man() into a new docs module
  • chore(github): comment out instructions in PR template
  • docs(dev-guide): reapply abandoned changes from #4970
  • Add riscv64 unknown linux musl support
  • fix(deps): update rust crate enum-map to v3
  • refactor(cli/self-update)!: rename install() to InstallOpts::install()
  • refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
  • refactor(cli/self-update)!: rename…
Record
openSUSE-SU-2026:22016-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22175-1 No score

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues:

  • CVE-2026-93599: rustls-webpki: panic in BorrowedCertRevocationList::from_der via empty BIT STRING in IssuingDistributionPoint (bsc#1282250).
  • CVE-2026-93600: rustls-webpki: name constraints for URI names were incorrectly accepted (bsc#1282250).
  • CVE-2026-93601: rustls-webpki: name constraints were accepted for certificates asserting a wildcard name (bsc#1282250).
  • CVE-2026-93602: rustls-webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic (bsc#1282250).
  • GHSA-7gcf-g7xr-8hxj: serde_with: KeyValueMap serialization panics on empty sequence or map entries (bsc#1271853).

Changes for aws-nitro-enclaves-cli:

  • Updated to version 1.5.2
Record
openSUSE-SU-2026:22175-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22189-1 No score

Security update for shadowsocks-rust, shadowsocks-libev

This update for shadowsocks-rust, shadowsocks-libev fixes the following issues:

Changes in shadowsocks-rust:

  • Fix SELinux denial (name_connect) when forwarding outbound TCP traffic (boo#1284975)

  • Fix: Unable to bind ports below 1024 with SELinux enabled (boo#1284025)

  • Update version to 1.25.0

    • Allow chaining ssserver to another SOCKS5/HTTP/HTTPS proxy

    • Expose user_key() on CryptoStream and ProxyServerStream, lets callers identify which multi-user identity was authenticated after an AEAD-2022 handshake

    • EIH (Extended Identity Header) support

    • local-http: Support HTTP Basic auth

    • service: Outbound UDP relay through SOCKS5-only chains. UDP traffic can now be relayed through proxy chains when all hops are SOCKS5. Chains containing HTTP/HTTPS hops will emit a startup warning and UDP traffic will bypass the chain.

    • socket2::Socket with socket2::SockRef

    • Fix bugs

      • CVE-2026-25541 and boo#1274441
      • CVE-2026-93599, CVE-2026-93602, CVE-2026-93601, CVE-2026-93600 and boo#1282208
      • CVE-2026-25541 and boo#1274441

    • Fix some issues (CVE-2025-3416, boo#1242615)

  • Update vendor, fix boo#1215658 and CVE-2023-42811

Changes in shadowsocks-libev:

  • Fix SELinux denial (name_connect) when forwarding outbound TCP traffic (boo#1284975)

  • Fix build for Leap 16.1+: switch BuildRequires from mbedtls-devel to mbedtls-3-devel Tumbleweed, don't do this work on Leap 16

Record
openSUSE-SU-2026:22189-1
Updated
2026-11-02
OSVRUSTSEC-2026-0099 No score

Name constraints were accepted for certificates asserting a wildcard name

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.

Record
RUSTSEC-2026-0099
Updated
2026-11-02
OSVSUSE-SU-2026:23983-1 No score

Security update for sccache

This update for sccache fixes the following issues:

  • CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
  • CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
  • CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
  • CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
  • CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
  • CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
  • CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
  • CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
  • CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
  • CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
  • CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
  • CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
  • CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
  • CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
  • CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
  • CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
  • CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
  • CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
  • CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

  • Add experimental concurrent cache support
  • chore: Remove dependency status badge (#2856)
  • Don't hand the jobserver to children that can't use it
  • dist: refuse to trim rlibs from crates that also emit a cdylib
  • fix(cache): avoid duplicate multilevel reads
  • Strip basedirs from the compiler arguments too
  • tests/integration: replace MinIO with Silo
  • ci: dump sccache logs on integration failures
  • multilevel: a chain with any writable level is writable
  • Fix parsing of #line directives
  • Release 0.18.0
  • daemonize: use an allow-list approach to inherited FDs
  • gcc, clang: make the assembler part of the cache key
  • support cl.exe /openmp:llvm
  • support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
  • support MSVC /feature argument
  • msvc: support lots of flags (#2832)
  • Update shlex dependency to version 2 (#2836)
  • gcc: mark flags as TooHard if need to cache something else (#2833)
  • clang: support more CLI options (#2834)
  • msvc: support arm64EC and fastfail flags (#2830)
  • chore: fix typo in comment (#2829)
  • nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
  • cache: allow skipping capability checks (#2822)
  • Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
  • nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
  • Add an agent (#2812)
  • Add support for d20bforceinline. (#2807)
  • feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
  • Bump MSRV to 1.91.0 (#2793)
  • Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
  • test: Fixed…
Record
SUSE-SU-2026:23983-1
Updated
2026-11-02
OSVSUSE-SU-2026:24014-1 No score

Security update for rustup

This update for rustup fixes the following issues:

  • CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
  • CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
  • CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
  • CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
  • CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
  • CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
  • CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
  • CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
  • CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
  • CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
  • CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
  • CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
  • CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
  • CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
  • CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
  • CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
  • rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

  • Update to version 1.29.1~0:
  • dist(rustup-init/sh): update commit shasum in help string
  • style(bin/rustup-init): reformat code
  • docs(changelog): update for v1.29.1 stable release
  • warn how to switch away from the deprecated complete profile
  • fix(cli/help): fix wording in rustup run --help
  • ci(docker/android): stop building OpenSSL
  • refactor(cli/docs): use tracing for docs opening status messages
  • refactor(self-update): rename Windows uninstall registry helpers
  • feat(test): isolate Windows registry state per test
  • docs(dev-guide): mention how to support new compilation targets
  • Fix funding link
  • chore(deps): lock file maintenance
  • refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
  • refactor(cli/self-update): move process out of InstallOpts
  • fix(cli/self-update): postpone initialization of Cfg in setup_mode
  • refactor(cli/self-update): take Process in check_existence_of_settings_file()
  • fix(settings): prevent creating new file with SettingsFile::read_settings()
  • test(cli-inst-interactive): test file creation on cancelled installation
  • refactor(toolchain/names): inline validate() aliases into FromStr
  • refactor(toolchain/names): rename validate() to normalize_name()
  • fix minor typos
  • www: align copy icon
  • refactor(toolchain/names)!: remove try_from_str!()
  • refactor(toolchain/names)!: remove from_variant!()
  • Add rustup doc --serve to serve docs over local HTTP
  • Move doc() and man() into a new docs module
  • chore(github): comment out instructions in PR template
  • docs(dev-guide): reapply abandoned changes from #4970
  • Add riscv64 unknown linux musl support
  • fix(deps): update rust crate enum-map to v3
  • refactor(cli/self-update)!: rename install() to InstallOpts::install()
  • refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
  • refactor(cli/self-update)!: rename…
Record
SUSE-SU-2026:24014-1
Updated
2026-11-02
OSVSUSE-SU-2026:24467-1 No score

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues:

  • CVE-2026-93599: rustls-webpki: panic in BorrowedCertRevocationList::from_der via empty BIT STRING in IssuingDistributionPoint (bsc#1282250).
  • CVE-2026-93600: rustls-webpki: name constraints for URI names were incorrectly accepted (bsc#1282250).
  • CVE-2026-93601: rustls-webpki: name constraints were accepted for certificates asserting a wildcard name (bsc#1282250).
  • CVE-2026-93602: rustls-webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic (bsc#1282250).
  • GHSA-7gcf-g7xr-8hxj: serde_with: KeyValueMap serialization panics on empty sequence or map entries (bsc#1271853).

Changes for aws-nitro-enclaves-cli:

  • Updated to version 1.5.2
Record
SUSE-SU-2026:24467-1
Updated
2026-11-04
OSVSUSE-SU-2026:5066-1 No score

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues:

  • CVE-2026-93599: rustls-webpki: Denial of service via panic on malformed CRL BIT STRING (bsc#1282250).
  • CVE-2026-93600: rustls-webpki: URI name constraint bypass in X.509 certificates (bsc#1282250).
  • CVE-2026-93601: rustls-webpki: DNS name constraint bypass for wildcard certificates (bsc#1282250).
  • CVE-2026-93602: rustls-webpki: CRL revocation check bypass via faulty distributionPoint matching (bsc#1282250).
  • serde_with: KeyValueMap serialization panics on empty sequence or map entries (bsc#1271853).

Changes for aws-nitro-enclaves-cli:

  • Updated to version 1.5.2.
Record
SUSE-SU-2026:5066-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rustls-webpki
crates.io
 0.101.0 up to 0.103.12
0.103.12
rustls-webpki
crates.io
 0.104.0-alpha.1 up to 0.104.0-alpha.6
0.104.0-alpha.6
kata-containers-cc
Azure Linux:3
 before 3.15.0.aks0-23
3.15.0.aks0-23
rust
Azure Linux:3
 through 1.75.0-31 None known
rust
Azure Linux:3
 1.85.0 to 1.98.1-1 None known
rust-afterburn
Azure Linux:3
 through 5.8.2-2 None known
rust-rustls-webpki
Debian:13
 All versions, plus listed versions
0.102.8-50.103.10+ds-10.103.13+ds-10.103.15+ds-10.103.4-1
Show 6 moreShow less
0.103.4-20.103.5-10.103.6-10.103.7-10.103.9+ds-10.103.9+ds-2
 None known
rust-rustls-webpki
Debian:14
 before 0.103.13+ds-1, plus listed versions
0.102.8-50.103.10+ds-10.103.4-10.103.4-20.103.5-1
Show 4 moreShow less
0.103.6-10.103.7-10.103.9+ds-10.103.9+ds-2
0.103.13+ds-1
rustls-webpki
crates.io
 0.0.0-0 up to 0.103.12, 0.104.0-alpha.1 up to 0.104.0-alpha.6
0.103.120.104.0-alpha.6
sccache
SUSE:Linux Enterprise Server 16.0
From an advisory covering 19 CVEs
 before 0.18.0~2-160000.1.1
0.18.0~2-160000.1.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
sccache
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 19 CVEs
 before 0.18.0~2-160000.1.1
0.18.0~2-160000.1.1
rustup
SUSE:Linux Enterprise Server 16.0
From an advisory covering 16 CVEs
 before 1.29.1~0-160000.1.1
1.29.1~0-160000.1.1
rustup
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 16 CVEs
 before 1.29.1~0-160000.1.1
1.29.1~0-160000.1.1
aws-nitro-enclaves-cli
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 1.5.2~git0.1c496ed-160000.1.1
1.5.2~git0.1c496ed-160000.1.1
aws-nitro-enclaves-cli
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 1.5.2~git0.1c496ed-160000.1.1
1.5.2~git0.1c496ed-160000.1.1
aws-nitro-enclaves-cli
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 4 CVEs
 before 1.5.2~git0.1c496ed-150600.10.18.1
1.5.2~git0.1c496ed-150600.10.18.1
aws-nitro-enclaves-cli
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 4 CVEs
 before 1.5.2~git0.1c496ed-150600.10.18.1
1.5.2~git0.1c496ed-150600.10.18.1
rust-rustls-webpki
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.101.4-40.101.7-2.1
 None known
rust-rustls-webpki
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.102.8-50.103.7-10.103.7-1build10.103.9+ds-10.103.9+ds-2
 None known
sequoia-sq
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 1.5.0-bp160.1.1
1.5.0-bp160.1.1
python-tokenizers
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.23.2-1.1
0.23.2-1.1
sccache
openSUSE:Leap 16.0
From an advisory covering 19 CVEs
 before 0.18.0~2-160000.1.1
0.18.0~2-160000.1.1
rustup
openSUSE:Leap 16.0
From an advisory covering 16 CVEs
 before 1.29.1~0-160000.1.1
1.29.1~0-160000.1.1
aws-nitro-enclaves-cli
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 1.5.2~git0.1c496ed-160000.1.1
1.5.2~git0.1c496ed-160000.1.1
shadowsocks-libev
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 3.3.6-bp160.3.1
3.3.6-bp160.3.1
shadowsocks-rust
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.25.0-bp160.1.1
1.25.0-bp160.1.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, referencesOSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93601 is a low vulnerability (CVSS 2.1) in Rustls Webpki, published April 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in rustls-webpki 0.103.12.

References

Show 69 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open