Rustls - vulnerabilities (CVEs)

5 CVEs in 2 products, 0 in the last 30 days, newest from 2026-09-18.

Products

• Webpki - 4 CVEs
• Rustls - 1 CVEs

Newest CVEs of Rustls

• CVE-2026-93602 - CVSS 5.9 (medium), 2026-09-18: rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against…
• CVE-2026-93601 - CVSS 2.2 (low), 2026-09-18: rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS…
• CVE-2026-93600 - CVSS 2.2 (low), 2026-09-18: rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to…
• CVE-2026-93599 - CVSS 8.7 (high), 2026-09-18: rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input…
• CVE-2024-32650 - CVSS 7.5 (high), 2024-04-19: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a…