Skip to content
cve.newCreate a CVE report

webpki-roots

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.8
GO-2026-6809Package fixes recorded

Bundled root certificates allow trust in distrusted emSign intermediates

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.

Recorded fixes — webpki-roots: 0.26.11 or 1.0.10; rustls-webpki: 0.103.16 or 0.104.0-alpha.8; 2 more packages. Check your release branch.

Exploitation not established

crates.io / webpki-rootscrates.io / rustls-webpkicrates.io / webpki-root-certs
webpki-roots crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.11Semantic versions0.26.11
From 0.26.12-0 before 1.0.10Semantic versions1.0.10

Version evidence: OSV · RUSTSEC-2026-0381

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.11"
        },
        {
          "introduced": "0.26.12-0"
        },
        {
          "fixed": "1.0.10"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}