Bug 2560009

Summary: CVE-2026-93601 awatcher: rustls-webpki: Name Constraint Bypass in wildcard certificate validation [fedora-all]
Product: [Fedora] Fedora Reporter: Ronit Dey <rdey>
Component: awatcherAssignee: wojnilowicz <lukasz.wojnilowicz>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: lukasz.wojnilowicz
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["94568926-7455-4c8f-8f71-63ce67f08abb"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2538656    

Description Ronit Dey 2026-10-23 16:06:28 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.