[PR #7115] [CLOSED] Bump rustls-webpki 0.103.11 to 0.103.12 #23414

New Issue

GiteaMirror · 2026-05-16T05:59:57-05:00

GiteaMirror commented

2026-05-16 05:59:57 -05:00

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/7115
Author: @ownrootops
Created: 4/21/2026
Status: ❌ Closed

Base: main ← Head: bump-rustls-webpki-0.103.12

📝 Commits (1)

c71fd0d Bump rustls-webpki 0.103.11 to 0.103.12

📊 Changes

1 file changed (+3 additions, -3 deletions)

View changed files

📝 Cargo.lock (+3 -3)

📄 Description

This PR updates rustls-webpki from 0.103.11 to 0.103.12 in
Cargo.lock to address two advisories published on 2026-04-15:

RUSTSEC-2026-0098 / GHSA-965h-392x-2mh5: URI name constraints
were silently accepted instead of rejected.
RUSTSEC-2026-0099 / GHSA-xgp8-3hg3-c2mh: permitted-subtree
DNS name constraints were accepted for certificates asserting a
wildcard name.

Both bugs are reachable only after signature verification and require
misissuance to exploit. Defense-in-depth fix.

The change was produced with cargo update -p rustls-webpki@0.103.11
and only Cargo.lock is modified. No other dependencies move.

Note on the second `rustls-webpki` copy

cargo audit also flags a second copy of rustls-webpki at 0.101.7,
pulled transitively via rocket 0.5.1 -> rustls 0.21.x. That copy
is not addressed here; resolving it requires a Rocket release
against a newer rustls tree, which is outside the scope of this PR.

References

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/7115 **Author:** [@ownrootops](https://github.com/ownrootops) **Created:** 4/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `bump-rustls-webpki-0.103.12` --- ### 📝 Commits (1) - [`c71fd0d`](https://github.com/dani-garcia/vaultwarden/commit/c71fd0d2dca634abfa850510f8cfc190d8282c59) Bump rustls-webpki 0.103.11 to 0.103.12 ### 📊 Changes **1 file changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+3 -3) </details> ### 📄 Description This PR updates `rustls-webpki` from 0.103.11 to 0.103.12 in `Cargo.lock` to address two advisories published on 2026-04-15: - **RUSTSEC-2026-0098** / GHSA-965h-392x-2mh5: URI name constraints were silently accepted instead of rejected. - **RUSTSEC-2026-0099** / GHSA-xgp8-3hg3-c2mh: permitted-subtree DNS name constraints were accepted for certificates asserting a wildcard name. Both bugs are reachable only after signature verification and require misissuance to exploit. Defense-in-depth fix. The change was produced with `cargo update -p rustls-webpki@0.103.11` and only `Cargo.lock` is modified. No other dependencies move. ### Note on the second `rustls-webpki` copy `cargo audit` also flags a second copy of `rustls-webpki` at 0.101.7, pulled transitively via `rocket 0.5.1` -> `rustls 0.21.x`. That copy is **not** addressed here; resolving it requires a Rocket release against a newer rustls tree, which is outside the scope of this PR. ### References - https://rustsec.org/advisories/RUSTSEC-2026-0098.html - https://rustsec.org/advisories/RUSTSEC-2026-0099.html - https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5 - https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-16 05:59:57 -05:00

GiteaMirror closed this issue

2026-05-16 05:59:58 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#23414

[PR #7115] [CLOSED] Bump rustls-webpki 0.103.11 to 0.103.12 #23414