Skip to content
cve.newCreate a CVE report

rustls-webpki

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.8
GO-2026-6809Package fixes recorded

Bundled root certificates allow trust in distrusted emSign intermediates

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.

Recorded fixes — webpki-roots: 0.26.11 or 1.0.10; rustls-webpki: 0.103.16 or 0.104.0-alpha.8; 2 more packages. Check your release branch.

Exploitation not established

crates.io / webpki-rootscrates.io / rustls-webpkicrates.io / webpki-root-certs
rustls-webpki crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.103.16Semantic versions0.103.16
From 0.104.0-alpha.1 before 0.104.0-alpha.8Semantic versions0.104.0-alpha.8

Version evidence: OSV · RUSTSEC-2026-0382

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.103.16"
        },
        {
          "introduced": "0.104.0-alpha.1"
        },
        {
          "fixed": "0.104.0-alpha.8"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}