CVE-2026-111943: rustls-webpki Certificate Verification Accepts Distrusted Intermediates
Summary
CVE-2026-111943: Certificate verification may accept distrusted intermediates. Affects rustls-webpki across 2 version ranges.
>= 0.0.0-0, < 0.103.16
>= 0.104.0-alpha.1, < 0.104.0-alpha.8
Fixed in 0.103.16 or 0.104.0-alpha.8, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
- webpki-roots · crates.io
- webpki-root-certs · crates.io
The same CVE-2026-111943 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rustls-webpki is a Rust library that provides a WebPKI certificate verification implementation. It is designed to ensure secure communications by validating SSL/TLS certificates against a set of trusted certificate authorities. The library is widely used in applications that require secure connections, making its integrity crucial for maintaining security standards.
Vulnerability Detail
The vulnerability arises from the acceptance of certificate paths that include distrusted emSign intermediate public keys. When the configured trust anchors allow such paths, it can lead to the acceptance of certificates that should be considered invalid. This issue is particularly concerning as the private keys corresponding to these intermediates are now well known, potentially allowing attackers to impersonate trusted entities and compromise secure communications.
How To Fix
Latest published version: 0.103.16 as of 23 Oct 2026
The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.104.0-alpha.1, < 0.104.0-alpha.80.104.0-alpha.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not use any certificate paths that include the distrusted emSign intermediate public keys. However, the best course of action is to update to the patched versions mentioned above.
Conclusion
The rustls-webpki library has a critical vulnerability that allows the acceptance of distrusted intermediates, posing a significant security risk. It is essential to update to the latest patched versions to ensure the integrity of secure communications. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for rustls-webpki →
FAQ
The vulnerability allows the acceptance of invalid certificate paths, which can lead to man-in-the-middle attacks and compromise secure communications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Affected versions include all versions prior to 0.103.16 and 0.104.0-alpha.8.
While the best solution is to update, you can temporarily avoid using distrusted intermediate public keys in your certificate paths.
If an immediate update is not possible, monitor your application for any suspicious activity and plan to update as soon as feasible.
Related vulnerabilities
Recent vulnerabilities recorded for rustls-webpki.
