rustls-webpki (crates.io)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.104.0-alpha.8 or later clears every advisory below that has a fix.

Upgrade commands

cargo

cargo update -p rustls-webpki --precise 0.104.0-alpha.8

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
RUSTSEC-2026-0382 Distrust compromised intermediate certificates in crypto/x509	Medium EPSS 0.40%	`>= 0.0.0-0, < 0.103.16` `>= 0.104.0-alpha.1, < 0.104.0-alpha.8`	`0.103.16` `0.104.0-alpha.8`
GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING	High EPSS 0.35%	`>= 0.104.0-alpha.1, < 0.104.0-alpha.7`	`0.104.0-alpha.7`
GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING	High EPSS 0.35%	`>= 0.0.0-0, < 0.103.13` `>= 0.104.0-alpha.1, < 0.104.0-alpha.7`	`0.103.13` `0.104.0-alpha.7`
GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING	High EPSS 0.35%	`< 0.103.13`	`0.103.13`
GHSA-965h-392x-2mh5 webpki: Name constraints for URI names were incorrectly accepted	Low EPSS 0.20%	`>= 0.0.0-0, < 0.103.12` `>= 0.104.0-alpha.1, < 0.104.0-alpha.6`	`0.103.12` `0.104.0-alpha.6`
GHSA-xgp8-3hg3-c2mh webpki: Name constraints were accepted for certificates asserting a wildcard name	Low EPSS 0.20%	`>= 0.104.0-alpha.1, < 0.104.0-alpha.6`	`0.104.0-alpha.6`
GHSA-xgp8-3hg3-c2mh webpki: Name constraints were accepted for certificates asserting a wildcard name	Low EPSS 0.20%	`>= 0.101.0, < 0.103.12`	`0.103.12`
GHSA-xgp8-3hg3-c2mh webpki: Name constraints were accepted for certificates asserting a wildcard name	Low EPSS 0.20%	`>= 0.0.0-0, < 0.103.12` `>= 0.104.0-alpha.1, < 0.104.0-alpha.6`	`0.103.12` `0.104.0-alpha.6`
GHSA-965h-392x-2mh5 webpki: Name constraints for URI names were incorrectly accepted	Low EPSS 0.20%	`>= 0.101.0, < 0.103.12`	`0.103.12`
GHSA-965h-392x-2mh5 webpki: Name constraints for URI names were incorrectly accepted	Low EPSS 0.20%	`>= 0.104.0-alpha.1, < 0.104.0-alpha.6`	`0.104.0-alpha.6`
GHSA-pwjx-qhcg-rvj4 webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic	Medium EPSS 0.20%	`>= 0.102.0-alpha.0, < 0.103.10`	`0.103.10`
GHSA-pwjx-qhcg-rvj4 webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic	Medium EPSS 0.20%	`>= 0.102.0-alpha.0, < 0.103.10`	`0.103.10`
GHSA-pwjx-qhcg-rvj4 webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic	Medium EPSS 0.20%	`>= 0.104.0-alpha.1, < 0.104.0-alpha.5`	`0.104.0-alpha.5`
GHSA-fh2r-99q2-6mmg rustls-webpki: CPU denial of service in certificate path building	High EPSS 6.48%	`< 0.100.2`	`0.100.2`
GHSA-fh2r-99q2-6mmg rustls-webpki: CPU denial of service in certificate path building	High EPSS 6.48%	`>= 0.101.0, < 0.101.4`	`0.101.4`
GHSA-fh2r-99q2-6mmg rustls-webpki: CPU denial of service in certificate path building	High EPSS 6.48%	`>= 0.0.0-0, < 0.100.2` `>= 0.101.0, < 0.101.4`	`0.100.2` `0.101.4`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor