CVE-2026-93601: 
Samba vulnerability analysis and mitigation

CVE-2026-93601 is a name constraint bypass vulnerability in rustls-webpki, the Rust webpki fork used by the rustls TLS library. The flaw causes permitted-subtree DNS name constraints to be incorrectly accepted for certificates asserting a wildcard name — for example, a constraint of accept.example.com is erroneously treated as satisfied by a certificate for *.example.com, which could assert reject.example.com, a name outside the permitted subtree. Affected versions are >= 0.101.0 and prior to 0.103.12, and 0.104.0-alpha.1 through 0.104.0-alpha.5. It was published on September 18, 2026, with patches released the same day. The CVSS v3.1 base score is 2.2 (Low) and the CVSS v4.0 base score is 2.1 (Low) (GitHub Advisory, rustls/webpki Advisory).

The root cause is improper certificate validation (CWE-295) combined with improper validation of unsafe equivalence in input (CWE-1289). When evaluating permitted-subtree name constraints, the library's logic incorrectly equates a wildcard certificate (e.g., *.example.com) with a specific permitted domain (e.g., accept.example.com), failing to account for the full range of names the wildcard could assert. Exploitation requires the attacker to already possess a misissued wildcard certificate from a trusted CA, and the vulnerability is only reachable after successful signature verification — meaning it cannot be triggered with a self-signed or untrusted certificate. This is noted as very similar to CVE-2025-61727, suggesting a pattern of related logic errors in wildcard name constraint handling (rustls/webpki Advisory, GitHub Advisory).

Successful exploitation allows an attacker holding a misissued wildcard certificate to bypass DNS name constraints enforced during TLS certificate validation, potentially impersonating services that should be restricted by those constraints. The integrity impact is limited — no confidentiality or availability impact is assessed — but the bypass could enable man-in-the-middle attacks against applications relying on name constraints as a security boundary. The scope is unchanged, meaning the impact is confined to the validating system, and no lateral movement or data exfiltration is directly enabled by this flaw alone (GitHub Advisory, rustls/webpki Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment classifies exploitation as "none" with non-automatable attack characteristics. The EPSS score is approximately 0.18% (7th percentile), reflecting a low probability of exploitation in the near term. Exploitation requires high privileges (possession of a misissued wildcard certificate from a trusted CA) and high attack complexity, significantly limiting the realistic attacker pool (GitHub Advisory, rustls/webpki Advisory).

Update rustls-webpki to version 0.103.12 or 0.104.0-alpha.6 (or later) to remediate the vulnerability. No configuration-based workaround is available; upgrading the dependency is the only fix. Organizations using Rust applications that depend on rustls or rustls-webpki should audit their Cargo.lock files for affected versions (>= 0.101.0, < 0.103.12 or 0.104.0-alpha.1 through 0.104.0-alpha.5) and update accordingly. An openSUSE security update has also been issued for downstream package consumers (rustls/webpki Advisory, Red Hat Bugzilla, GitHub Advisory).

The vulnerability was reported by security researcher 1seal and published by the rustls maintainer ctz via a GitHub Security Advisory (rustls/webpki Advisory). Red Hat tracked the issue via Bugzilla with a low severity rating, and Microsoft acknowledged it through their Security Response Center (Red Hat Bugzilla, Microsoft MSRC). No significant broader community controversy or media coverage has been observed, consistent with the low CVSS score and high exploitation prerequisites.