The rustls-webpki library versions >=0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accept permitted-subtree DNS name constraints for certificates asserting wildcard names. Specifically, a name constraint such as accept.example.com was erroneously treated as satisfied by a certificate for *.example.com, which could assert reject.example.com, a name outside the permitted subtree. This flaw arises because name constraints are meant to restrict otherwise valid certificates, and the issue is only exploitable after the certificate signature verification succeeds, requiring a misissued wildcard certificate.

This vulnerability could allow a certificate with a wildcard name to assert DNS names outside the permitted subtree defined by name constraints, potentially enabling unauthorized use of domain names. However, exploitation requires a misissued wildcard certificate and occurs only after successful signature verification. The CVSS score of 2.1 indicates low severity, reflecting limited impact and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor rustls-webpki releases for updates addressing this issue and apply official fixes when available. Until then, be aware of the risk posed by misissued wildcard certificates in affected versions.