{"aliases":["CVE-2026-111943"],"categories":["crypto-failure"],"crate":"rustls-webpki","cves":["CVE-2026-111943"],"cvss":0.0,"database_specific":{"severity":""},"date":"2026-10-20","deb_packages":[{"crate_name":"acme-redirect","deb_name":"acme-redirect","version":"0.8.1+ds-1"},{"crate_name":"apt-swarm","deb_name":"apt-swarm","version":"0.6.0-3"},{"crate_name":"apt-transport-blob","deb_name":"apt-transport-blob","version":"1.2.2-1+b2"},{"crate_name":"bmap-rs","deb_name":"bmap-rs","version":"0.2.3-1"},{"crate_name":"cargo-audit","deb_name":"cargo-audit","version":"0.22.2-1+b3"},{"crate_name":"css-inline","deb_name":"css-inline","version":"0.22.0-1"},{"crate_name":"debian-lsp","deb_name":"debian-lsp","version":"0.1.8-5+b2"},{"crate_name":"debian-repro-status","deb_name":"debian-repro-status","version":"0.4.0-3"},{"crate_name":"sequoia-chameleon-gnupg","deb_name":"gpg-sq","version":"0.13.1-15"},{"crate_name":"sequoia-chameleon-gnupg","deb_name":"gpgv-sq","version":"0.13.1-15"},{"crate_name":"hickory-dns","deb_name":"hickory-dns","version":"0.26.3-1+b2"},{"crate_name":"hussh","deb_name":"hussh","version":"0.2.3-1"},{"crate_name":"hypothesis","deb_name":"hypothesis-client","version":"0.12.0-4+b3"},{"crate_name":"icu4x-datagen","deb_name":"icu4x-datagen","version":"2.2.0-1+b2"},{"crate_name":"rustls-webpki","deb_name":"librust-rustls-webpki-0.101-dev","version":"0.101.7-7"},{"crate_name":"miniserve","deb_name":"miniserve","version":"0.35.0-6"},{"crate_name":null,"deb_name":"nethsm-pkcs11","version":"2.0.0-3+b2"},{"crate_name":"ntpd","deb_name":"ntpd-rs","version":"1.9.0-1+b2"},{"crate_name":"ntpd","deb_name":"ntpd-rs-metrics","version":"1.9.0-1+b2"},{"crate_name":"numbat-cli","deb_name":"numbat","version":"1.24.0-1"},{"crate_name":"ognibuild","deb_name":"ognibuild","version":"0.2.21-1"},{"crate_name":null,"deb_name":"patch-hub","version":"0.1.7-3+b2"},{"crate_name":"protonup-rs","deb_name":"protonup-rs","version":"0.15.0-1+b2"},{"crate_name":"prr","deb_name":"prr","version":"0.21.0-2+b2"},{"crate_name":"rbw","deb_name":"rbw","version":"1.15.0-2+b2"},{"crate_name":"rebuildctl","deb_name":"rebuildctl","version":"0.28.0-2"},{"crate_name":"rebuilderd","deb_name":"rebuilderd","version":"0.28.0+ds-2+b2"},{"crate_name":"rebuilderd-worker","deb_name":"rebuilderd-worker","version":"0.28.0-1+b2"},{"crate_name":"repro-env","deb_name":"repro-env","version":"0.4.4+ds-1"},{"crate_name":"repro-threshold","deb_name":"repro-threshold","version":"0.1.2-1+b2"},{"crate_name":"ripasso-cursive","deb_name":"ripasso-cursive","version":"0.8.0-1+b7"},{"crate_name":null,"deb_name":"safe-vdash","version":"0.20.0-6+b2"},{"crate_name":"samply","deb_name":"samply","version":"0.13.1-1+b2"},{"crate_name":"sequoia-git","deb_name":"sequoia-git","version":"0.6.0-2+b2"},{"crate_name":"signal-tlsd","deb_name":"signal-tlsd","version":"0.1.4-1+b2"},{"crate_name":"silver-platter","deb_name":"silver-platter","version":"0.8.4-2+b3"},{"crate_name":"spytrap-adb","deb_name":"spytrap-adb","version":"0.3.5-6"},{"crate_name":"sequoia-sq","deb_name":"sq","version":"1.4.1-2"},{"crate_name":null,"deb_name":"taskwarrior","version":"3.5.0+dfsg-3+b2"},{"crate_name":"tealdeer","deb_name":"tealdeer","version":"1.9.0-2"},{"crate_name":"xh","deb_name":"xh","version":"0.26.3-1"}],"description":"Affected versions may accept certificate paths containing distrusted emSign\nintermediate public keys when the configured trust anchors allow such paths.\nThe private keys corresponding to these intermediates are now well known.\n\nVersions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.","id":"RUSTSEC-2026-0382","keywords":["certificate","distrust","x509"],"patched_versions":[">=0.103.16, <0.104.0-alpha.1",">=0.104.0-alpha.8"],"source":"debian_rustsec","title":"Certificate verification may accept distrusted intermediates","url":"https://github.com/rustls/webpki/pull/546"}