Repository navigation
RUSTSEC-2026-0382: Certificate verification may accept distrusted intermediates #591
Description
Certificate verification may accept distrusted intermediates
| Details | |
|---|---|
| Package | rustls-webpki |
| Version | 0.103.13 |
| URL | rustls/webpki#546 |
| Date | 2026-10-20 |
| Patched versions | >=0.103.16, <0.104.0-alpha.1,>=0.104.0-alpha.8 |
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys when the configured trust anchors allow such paths.
The private keys corresponding to these intermediates are now well known.
Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.
See advisory page for additional details.
Activity