RUSTSEC-2026-0382

vendorUSosv

Certificate verification may accept distrusted intermediates

view advisory published 2026-10-20Licence: CC0-1.0

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys when the configured trust anchors allow such paths. The private keys corresponding to these intermediates are now well known. Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-111943US	—	0.30% (22nd)	Exploit	2026-10-21
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against…

references

External citations — patches, advisories, analysis.

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449WEB
https://crates.io/crates/rustls-webpkiPACKAGE
https://emudhra.we-have-a-problem.com/WEB
https://github.com/rustls/webpki/pull/546WEB
https://rustsec.org/advisories/RUSTSEC-2026-0382.htmlADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan