{"id":"RUSTSEC-2026-0382","summary":"Certificate verification may accept distrusted intermediates","details":"Affected versions may accept certificate paths containing distrusted emSign\nintermediate public keys when the configured trust anchors allow such paths.\nThe private keys corresponding to these intermediates are now well known.\n\nVersions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.","aliases":["CVE-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0383"],"modified":"2026-10-21T00:55:56.763143468Z","published":"2026-10-20T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/rustls-webpki"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0382.html"},{"type":"WEB","url":"https://github.com/rustls/webpki/pull/546"},{"type":"WEB","url":"https://emudhra.we-have-a-problem.com/"},{"type":"WEB","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449"}],"affected":[{"package":{"name":"rustls-webpki","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.103.16"},{"introduced":"0.104.0-alpha.1"},{"fixed":"0.104.0-alpha.8"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":[],"arch":[]}},"database_specific":{"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0382.json","categories":["crypto-failure"]}}],"schema_version":"1.9.0"}