Bundled root certificates allow trust in distrusted emSign intermediates

Bundled root certificates allow trust in distrusted emSign intermediates

Certificate verification may accept distrusted intermediates

Excluded iPAddress name constraints with an all-zero mask are not applied

Reachable panic in certificate revocation list parsing

Name constraints for URI names were incorrectly accepted

Name constraints were accepted for certificates asserting a wildcard name

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

CRLs not considered authoritative by Distribution Point due to faulty matching logic

webpki: CPU denial of service in certificate path building

rustls-webpki: CPU denial of service in certificate path building