Prepare 0.103.12 by djc · Pull Request #470 · rustls/webpki

djc · 2026-04-13T14:55:44Z

I've run out of time for now to write some good release notes for this.

Backports:

Compared with the original pull requests, these commits bring in some bits of test support code that did not exist on this branch yet.

djc · 2026-04-13T14:57:01Z

Ugh, I guess the old test code generation stuff doesn't interoperate well with the new stuff.

If someone wants to take the baton, feel free. Otherwise I'll probably get to it tomorrow at the earliest.

codecov · 2026-04-13T14:57:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.38%. Comparing base (57bc62c) to head (2e5db7e).
⚠️ Report is 4 commits behind head on rel-0.103.

Additional details and impacted files

@@              Coverage Diff              @@
##           rel-0.103     #470      +/-   ##
=============================================
+ Coverage      97.36%   97.38%   +0.01%     
=============================================
  Files             19       19              
  Lines           3792     3819      +27     
=============================================
+ Hits            3692     3719      +27     
  Misses           100      100

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ctz · 2026-04-14T07:45:54Z

Proposed release notes:

This release fixes two bugs in name constraint enforcement:

GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

djc · 2026-04-14T07:50:22Z

Nice!

ctz

(my changes here were to move all changes in tests/tls_server_certs.rs "above the fold" so code generation ignores them.)

Bumps [rustls-webpki](https://github.com/rustls/webpki) from 0.103.8 to 0.103.13. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rustls/webpki/releases">rustls-webpki's releases</a>.</em></p> <blockquote> <h2>0.103.13</h2> <ul> <li><strong>Fix reachable panic in parsing a CRL</strong>. This was reported to us as <a href="https://github.com/rustls/webpki/security/adv isories/GHSA-82j2-j2ch-gfr8">GHSA-82j2-j2ch-gfr8</a>. Users who don't use CRLs are not affected.</li> <li>For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See <a href="https ://redirect.github.com/rustls/webpki/pull/471">rustls/webpki#471</a>. This was a case missing in the fix for <a href="https://github.com/advis ories/GHSA-965h-392x-2mh5">https://github.com/advisories/GHSA-965h-392x- 2mh5</a>.</li> </ul> <h2>What's Changed</h2> <ul> <li>Actually fail closed for URI matching against excluded subtrees by <a href="https://github.com/djc"><code>@djc</code></a> in <a href="http s://redirect.github.com/rustls/webpki/pull/473">rustls/webpki#473</a></l i> <li>Prepare 0.103.13 by <a href="https://github.com/ctz"><code>@ctz</code></a> in <a href="https:/ /redirect.github.com/rustls/webpki/pull/474">rustls/webpki#474</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rustls/w ebpki/compare/v/0.103.12...v/0.103.13">https://github.com/rustls/webpki/ compare/v/0.103.12...v/0.103.13</a></p> <h2>0.103.12</h2> <p>This release fixes two bugs in name constraint enforcement:</p> <ul> <li><strong>GHSA-965h-392x-2mh5</strong>: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.</li> <li><strong>GHSA-xgp8-3hg3-c2mh</strong>: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of <code>accept.example.com</code>, <code>*.example.com</code> could feasibly allow a name of <code>reject.example.com</code> which is outside the constraint. This is very similar to <a href="https://go.dev/issue/76442">CVE-2025-61727</a>.</li> </ul> <p>Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.</p> <h2>What's Changed</h2> <ul> <li>Prepare 0.103.12 by <a href="https://github.com/djc"><code>@djc</code></a> in <a href="https:/ /redirect.github.com/rustls/webpki/pull/470">rustls/webpki#470</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rustls/w ebpki/compare/v/0.103.11...v/0.103.12">https://github.com/rustls/webpki/ compare/v/0.103.11...v/0.103.12</a></p> <h2>0.103.11</h2> <p>In response to <a href="https://redirect.github.com/rustls/webpki/issues/464">#464</a>, we've slightly relaxed requirements for <code>anchor_from_trust_cert()</code> to ignore unknown extensions even if they're marked as critical. This only affects parsing a <code>TrustAnchor</code> from DER, for which most extensions are ignored anyway.</p> <h2>What's Changed</h2> <ul> <li>Backport parsing trust anchors with unknown critical extensions to 0.103 by <a href="https://github.com/djc"><code>@djc</code></a> in <a h ref="https://redirect.github.com/rustls/webpki/pull/466">rustls/webpki#4 66</a></li> </ul> <h2>0.103.10</h2> <p><strong>Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point</strong>. If a certificate had more than one <code>distributionPoint</code>, then only the first <code>distributionPoint</code> would be considered against each CRL's <code>IssuingDistributionPoint</code> <code>distributionPoint</code>, and then the certificate's subsequent <code>distributionPoint</code>s would be ignored.</p> <p>The impact was that correctly provided CRLs would not be consulted to check revocation. With <code>UnknownStatusPolicy::Deny</code> (the default) this would lead to incorrect but safe <code>Error::UnknownRevocationStatus</code>. With <code>UnknownStatusPolicy::Allow</code> this would lead to inappropriate acceptance of revoked certificates.</p> <p>This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)</p> <p>More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.</p> <p>This vulnerability is identified by <a href="https://github.com/rustls/webpki/security/advisories/GHSA-pwjx- qhcg-rvj4">GHSA-pwjx-qhcg-rvj4</a>. Thank you to <a href="https://github.com/1seal"><code>@1seal</code></a> for the report.</p> <h2>What's Changed</h2> <ul> <li>Freshen up rel-0.103 by <a href="https://github.com/ctz"><code>@ctz</code></a> in <a href="https:/ /redirect.github.com/rustls/webpki/pull/455">rustls/webpki#455</a></li> <li>Prepare 0.103.10 by <a href="https://github.com/ctz"><code>@ctz</code></a> in <a href="https:/ /redirect.github.com/rustls/webpki/pull/458">rustls/webpki#458</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rustls/w ebpki/compare/v/0.103.9...v/0.103.10">https://github.com/rustls/webpki/c ompare/v/0.103.9...v/0.103.10</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="rustls/webpki@2879b2ce7a476181ac3 050f73fe0835f04728e86"><code>2879b2c</code></a> Prepare 0.103.13</li> <li><a href="rustls/webpki@2c49773d823f48c87db 30db7a66c25993c847007"><code>2c49773</code></a> Improve tests for padding of <code>BitStringFlags</code></li> <li><a href="rustls/webpki@4e3c0b393a7bfb9cbe6 dcdc8309cbadf8ee00c51"><code>4e3c0b3</code></a> Correct validation of BIT STRING constraints</li> <li><a href="rustls/webpki@39c91d2525a542a7f65 1a1a62c3462e8115cc39e"><code>39c91d2</code></a> Actually fail closed for URI matching against excluded subtrees</li> <li><a href="rustls/webpki@27131d476e2b68a537e 629d6d012bef8dad6efd3"><code>27131d4</code></a> Bump version to 0.103.12</li> <li><a href="rustls/webpki@6ecb8769cde2246e761 e058709421c14a7dee6b1"><code>6ecb876</code></a> Clean up stuttery enum variant names</li> <li><a href="rustls/webpki@318b3e6e03ca2bc2160 0ca6bb0d0c6439b9e6aeb"><code>318b3e6</code></a> Ignore wildcard labels when matching name constraints</li> <li><a href="rustls/webpki@12196229a327d3d6707 98688254bd3ea24aba24b"><code>1219622</code></a> Rewrite constraint matching to avoid permissive catch-all branch</li> <li><a href="rustls/webpki@57bc62ce538c2d0d31d 44b3eb8c58e6a0a764b47"><code>57bc62c</code></a> Bump version to 0.103.11</li> <li><a href="rustls/webpki@d0fa01ee0a76b7585c1 3ec43de5854955146ffef"><code>d0fa01e</code></a> Allow parsing trust anchors with unknown criticial extensions</li> <li>Additional commits viewable in <a href="https://github.com/rustls/we bpki/compare/v/0.103.8...v/0.103.13">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot- badges.githubapp.com/badges/compatibility_score?dependency-name=rustls- webpki&package-manager=cargo&previous-version=0.103.8&new- version=0.103.13)](https://docs.github.com/en/github/managing-security- vulnerabilities/about-dependabot-security-updates#about-compatibility- scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/tursodatabase/turso/network/alerts). </details> Closes #6505

ctz self-assigned this Apr 14, 2026

ctz force-pushed the prepare-0.103.12 branch from 320e0c4 to 17c21c9 Compare April 14, 2026 07:24

djc added 4 commits April 14, 2026 08:31

Rewrite constraint matching to avoid permissive catch-all branch

ebfe7ff

Ignore wildcard labels when matching name constraints

caa1f56

Clean up stuttery enum variant names

c4b6b82

Bump version to 0.103.12

2e5db7e

ctz force-pushed the prepare-0.103.12 branch from 17c21c9 to 2e5db7e Compare April 14, 2026 07:33

ctz removed their assignment Apr 14, 2026

ctz approved these changes Apr 14, 2026

View reviewed changes

ctz added this pull request to the merge queue Apr 14, 2026

Merged via the queue into rel-0.103 with commit 27131d4 Apr 14, 2026
40 checks passed

ctz deleted the prepare-0.103.12 branch April 14, 2026 09:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prepare 0.103.12#470

Prepare 0.103.12#470
ctz merged 4 commits into
rel-0.103from
prepare-0.103.12

djc commented Apr 13, 2026

Uh oh!

djc commented Apr 13, 2026

Uh oh!

codecov Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

ctz commented Apr 14, 2026 •

edited

Loading

Uh oh!

djc commented Apr 14, 2026

Uh oh!

ctz left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

djc commented Apr 13, 2026

Uh oh!

djc commented Apr 13, 2026

Uh oh!

codecov Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ctz commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

djc commented Apr 14, 2026

Uh oh!

ctz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Apr 13, 2026 •

edited

Loading

ctz commented Apr 14, 2026 •

edited

Loading