Deps.rs

actix-tls 3.3.0

[![dependency status](https://deps.rs/crate/actix-tls/3.3.0/status.svg)](https://deps.rs/crate/actix-tls/3.3.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate actix-tls

Dependencies

(19 total, 6 outdated, 1 insecure)

CrateRequiredLatestStatus
 actix-rt^2.22.15.0up to date
 actix-service^22.0.3up to date
 actix-utils^33.0.2up to date
 futures-core^0.3.70.3.34up to date
 http^11.5.0up to date
 impl-more^0.10.3.8out of date
 pin-project-lite^0.2.70.2.17up to date
 rustls^0.21.60.23.45out of date
 rustls-native-certs^0.70.8.4out of date
 rustls-pki-types^11.15.1up to date
 rustls-webpki ⚠️^0.101.40.103.15insecure
 openssl^0.10.550.10.81up to date
 tokio^1.23.11.53.1up to date
 tokio-native-tls^0.30.3.1up to date
 tokio-openssl^0.60.6.5up to date
 tokio-rustls^0.250.26.5out of date
 tokio-util^0.70.7.19up to date
 tracing^0.1.300.1.44up to date
 webpki-roots^0.261.0.9out of date

Security Vulnerabilities

rustls-webpki: Name constraints for URI names were incorrectly accepted

RUSTSEC-2026-0098

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-965h-392x-2mh5. Thank you to @1seal for the report.

rustls-webpki: Name constraints were accepted for certificates asserting a wildcard name

RUSTSEC-2026-0099

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.

rustls-webpki: Reachable panic in certificate revocation list parsing

RUSTSEC-2026-0104

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.