{ "cveId": "CVE-2026-93601", "url": "https://patchblox.com/security/cve/CVE-2026-93601", "summary": "CVE-2026-93601 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2026-93601, released September 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass", "description": "rustls-webpki (the Rust webpki fork used by rustls) versions \u003E= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com \u2014 a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.", "published": "2026-09-18T14:19:11Z", "severity": "Low", "cvss": 2.2, "cwe": "Improper Certificate Validation", "epss": 0.00203, "epssPercentile": 0.10341, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93601", "fixes": [ { "platform": "linux", "product": "asciinema", "release": "Fedora 43", "fixedVersion": "3.0.0-8.fc43", "fix": "FEDORA-2026-050BC124DF", "url": "https://patchblox.com/security/fix/linux/fedora-2026-050bc124df", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "asciinema-debuginfo", "release": "Fedora 43", "fixedVersion": "3.0.0-8.fc43", "fix": "FEDORA-2026-050BC124DF", "url": "https://patchblox.com/security/fix/linux/fedora-2026-050bc124df", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "asciinema-debugsource", "release": "Fedora 43", "fixedVersion": "3.0.0-8.fc43", "fix": "FEDORA-2026-050BC124DF", "url": "https://patchblox.com/security/fix/linux/fedora-2026-050bc124df", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "aws-nitro-enclaves-cli", "release": "opensuse-leap 16.0", "fixedVersion": "1.5.2~git0.1c496ed-160000.1.1", "fix": "OPENSUSE-SU-2026:22175-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22175-1", "released": "2026-11-07T00:48:28Z" }, { "platform": "linux", "product": "aws-nitro-enclaves-cli", "release": "sles 15.6", "fixedVersion": "1.5.2~git0.1c496ed-150600.10.18.1", "fix": "SUSE-SU-2026:5066-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5066-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "aws-nitro-enclaves-cli", "release": "sles 15.7", "fixedVersion": "1.5.2~git0.1c496ed-150600.10.18.1", "fix": "SUSE-SU-2026:5066-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5066-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "aws-nitro-enclaves-cli", "release": "sles 16.0", "fixedVersion": "1.5.2~git0.1c496ed-160000.1.1", "fix": "SUSE-SU-2026:24467-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24467-1", "released": "2026-11-07T00:45:20Z" }, { "platform": "linux", "product": "fractal", "release": "Fedora 43", "fixedVersion": "14.3-1.fc43", "fix": "FEDORA-2026-DB5DD4BC2F", "url": "https://patchblox.com/security/fix/linux/fedora-2026-db5dd4bc2f", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "fractal-debuginfo", "release": "Fedora 43", "fixedVersion": "14.3-1.fc43", "fix": "FEDORA-2026-DB5DD4BC2F", "url": "https://patchblox.com/security/fix/linux/fedora-2026-db5dd4bc2f", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "fractal-debugsource", "release": "Fedora 43", "fixedVersion": "14.3-1.fc43", "fix": "FEDORA-2026-DB5DD4BC2F", "url": "https://patchblox.com/security/fix/linux/fedora-2026-db5dd4bc2f", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "ntpd-rs", "release": "Fedora 43", "fixedVersion": "1.7.2-3.fc43", "fix": "FEDORA-2026-A9929D5B4B", "url": "https://patchblox.com/security/fix/linux/fedora-2026-a9929d5b4b", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "ntpd-rs-debuginfo", "release": "Fedora 43", "fixedVersion": "1.7.2-3.fc43", "fix": "FEDORA-2026-A9929D5B4B", "url": "https://patchblox.com/security/fix/linux/fedora-2026-a9929d5b4b", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "ntpd-rs-debugsource", "release": "Fedora 43", "fixedVersion": "1.7.2-3.fc43", "fix": "FEDORA-2026-A9929D5B4B", "url": "https://patchblox.com/security/fix/linux/fedora-2026-a9929d5b4b", "released": "2026-11-07T01:05:44Z" }, { "platform": "linux", "product": "rust-rustls-webpki", "release": "Debian 14", "fixedVersion": "0.103.13\u002Bds-1", "fix": "DEBIAN-CVE-2026-93601", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93601", "released": "2026-09-19T18:30:58Z" }, { "platform": "linux", "product": "rustup", "release": "opensuse-leap 16.0", "fixedVersion": "1.29.1~0-160000.1.1", "fix": "OPENSUSE-SU-2026:22016-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22016-1", "released": "2026-10-02T19:31:21Z" }, { "platform": "linux", "product": "rustup", "release": "sles 16.0", "fixedVersion": "1.29.1~0-160000.1.1", "fix": "SUSE-SU-2026:24014-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24014-1", "released": "2026-10-02T19:21:30Z" }, { "platform": "linux", "product": "sccache", "release": "opensuse-leap 16.0", "fixedVersion": "0.18.0~2-160000.1.1", "fix": "OPENSUSE-SU-2026:21982-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21982-1", "released": "2026-09-30T17:58:26Z" }, { "platform": "linux", "product": "sccache", "release": "sles 16.0", "fixedVersion": "0.18.0~2-160000.1.1", "fix": "SUSE-SU-2026:23983-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23983-1", "released": "2026-09-30T17:49:13Z" }, { "platform": "linux", "product": "sequoia-sq", "release": "opensuse-leap 16.0", "fixedVersion": "1.5.0-bp160.1.1", "fix": "OPENSUSE-RU-2026:22132-1", "url": "https://patchblox.com/security/fix/linux/opensuse-ru-2026-22132-1", "released": "2026-11-07T00:48:28Z" }, { "platform": "linux", "product": "shadowsocks-libev", "release": "opensuse-leap 16.0", "fixedVersion": "3.3.6-bp160.3.1", "fix": "OPENSUSE-SU-2026:22189-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22189-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "shadowsocks-rust", "release": "opensuse-leap 16.0", "fixedVersion": "1.25.0-bp160.1.1", "fix": "OPENSUSE-SU-2026:22189-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22189-1", "released": "2026-11-07T00:47:19Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }