Reported

October 20, 2026

Issued

October 20, 2026

Package

rustls-webpki (crates.io)

Type

Vulnerability

Categories

• crypto-failure

Keywords

#certificate #distrust #x509

Aliases

• CVE-2026-111943

References

• https://github.com/rustls/webpki/pull/546
• https://emudhra.we-have-a-problem.com/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Patched

• >=0.103.16, <0.104.0-alpha.1
• >=0.104.0-alpha.8

Description

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys when the configured trust anchors allow such paths. The private keys corresponding to these intermediates are now well known.

Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.

Advisory available under CC0-1.0 license.