rustsec-2026-0382

{
  "aliases": [
    "CVE-2026-111943"
  ],
  "categories": [
    "crypto-failure"
  ],
  "crate": "rustls-webpki",
  "cves": [
    "CVE-2026-111943"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-20",
  "deb_packages": [
    {
      "crate_name": "acme-redirect",
      "deb_name": "acme-redirect",
      "version": "0.8.1+ds-1"
    },
    {
      "crate_name": "apt-swarm",
      "deb_name": "apt-swarm",
      "version": "0.6.0-3"
    },
    {
      "crate_name": "apt-transport-blob",
      "deb_name": "apt-transport-blob",
      "version": "1.2.2-1+b2"
    },
    {
      "crate_name": "bmap-rs",
      "deb_name": "bmap-rs",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "cargo-audit",
      "deb_name": "cargo-audit",
      "version": "0.22.2-1+b3"
    },
    {
      "crate_name": "css-inline",
      "deb_name": "css-inline",
      "version": "0.22.0-1"
    },
    {
      "crate_name": "debian-lsp",
      "deb_name": "debian-lsp",
      "version": "0.1.8-5+b2"
    },
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "sequoia-chameleon-gnupg",
      "deb_name": "gpg-sq",
      "version": "0.13.1-15"
    },
    {
      "crate_name": "sequoia-chameleon-gnupg",
      "deb_name": "gpgv-sq",
      "version": "0.13.1-15"
    },
    {
      "crate_name": "hickory-dns",
      "deb_name": "hickory-dns",
      "version": "0.26.3-1+b2"
    },
    {
      "crate_name": "hussh",
      "deb_name": "hussh",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "hypothesis",
      "deb_name": "hypothesis-client",
      "version": "0.12.0-4+b3"
    },
    {
      "crate_name": "icu4x-datagen",
      "deb_name": "icu4x-datagen",
      "version": "2.2.0-1+b2"
    },
    {
      "crate_name": "rustls-webpki",
      "deb_name": "librust-rustls-webpki-0.101-dev",
      "version": "0.101.7-7"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": null,
      "deb_name": "nethsm-pkcs11",
      "version": "2.0.0-3+b2"
    },
    {
      "crate_name": "ntpd",
      "deb_name": "ntpd-rs",
      "version": "1.9.0-1+b2"
    },
    {
      "crate_name": "ntpd",
      "deb_name": "ntpd-rs-metrics",
      "version": "1.9.0-1+b2"
    },
    {
      "crate_name": "numbat-cli",
      "deb_name": "numbat",
      "version": "1.24.0-1"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": null,
      "deb_name": "patch-hub",
      "version": "0.1.7-3+b2"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "prr",
      "deb_name": "prr",
      "version": "0.21.0-2+b2"
    },
    {
      "crate_name": "rbw",
      "deb_name": "rbw",
      "version": "1.15.0-2+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": "repro-env",
      "deb_name": "repro-env",
      "version": "0.4.4+ds-1"
    },
    {
      "crate_name": "repro-threshold",
      "deb_name": "repro-threshold",
      "version": "0.1.2-1+b2"
    },
    {
      "crate_name": "ripasso-cursive",
      "deb_name": "ripasso-cursive",
      "version": "0.8.0-1+b7"
    },
    {
      "crate_name": null,
      "deb_name": "safe-vdash",
      "version": "0.20.0-6+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    },
    {
      "crate_name": "sequoia-git",
      "deb_name": "sequoia-git",
      "version": "0.6.0-2+b2"
    },
    {
      "crate_name": "signal-tlsd",
      "deb_name": "signal-tlsd",
      "version": "0.1.4-1+b2"
    },
    {
      "crate_name": "silver-platter",
      "deb_name": "silver-platter",
      "version": "0.8.4-2+b3"
    },
    {
      "crate_name": "spytrap-adb",
      "deb_name": "spytrap-adb",
      "version": "0.3.5-6"
    },
    {
      "crate_name": "sequoia-sq",
      "deb_name": "sq",
      "version": "1.4.1-2"
    },
    {
      "crate_name": null,
      "deb_name": "taskwarrior",
      "version": "3.5.0+dfsg-3+b2"
    },
    {
      "crate_name": "tealdeer",
      "deb_name": "tealdeer",
      "version": "1.9.0-2"
    },
    {
      "crate_name": "xh",
      "deb_name": "xh",
      "version": "0.26.3-1"
    }
  ],
  "description": "Affected versions may accept certificate paths containing distrusted emSign\nintermediate public keys when the configured trust anchors allow such paths.\nThe private keys corresponding to these intermediates are now well known.\n\nVersions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.",
  "id": "RUSTSEC-2026-0382",
  "keywords": [
    "certificate",
    "distrust",
    "x509"
  ],
  "patched_versions": [
    ">=0.103.16, <0.104.0-alpha.1",
    ">=0.104.0-alpha.8"
  ],
  "source": "debian_rustsec",
  "title": "Certificate verification may accept distrusted intermediates",
  "url": "https://github.com/rustls/webpki/pull/546"
}