#1151660 rust-rustls-webpki: Certificate verification may accept distrusted intermediates (RUSTSEC-2026-0382, CVE-2026-111943)

Package:
rust-rustls-webpki
Source:
rust-rustls-webpki
Submitter:
kpcyrd
Date:
2026-10-22 19:05:01 UTC
Severity:
normal
#1151660#5
Date:
2026-10-22 17:22:37 UTC
From:
To:
Hello!

In connection to the eMudhra fallout, the rustls team has issued an outdate that
explicitly rejects eMudhra CA intermediates.

The description text of CVE-2026-111943 is Go specific, but it seems it's
currently used to identify this incident in general.

Please update the rust-rustls-webpki package to >= 0.103.16.

Thank you!