Deps.rs

trust-dns-client 0.23.2

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate trust-dns-client

Dependencies

(14 total, 5 outdated, 1 insecure)

CrateRequiredLatestStatus
 cfg-if^11.0.5up to date
 data-encoding^2.2.02.11.1up to date
 futures-channel^0.3.50.3.34up to date
 futures-util^0.3.50.3.34up to date
 once_cell^1.18.01.21.4up to date
 radix_trie^0.2.00.3.0out of date
 rand^0.80.10.2out of date
 rustls^0.21.00.23.45out of date
 serde^1.01.0.229up to date
 thiserror^1.0.202.0.20out of date
 tokio^1.211.53.1up to date
 tracing^0.1.300.1.44up to date
 trust-dns-proto^0.23.20.23.2up to date
 rustls-webpki ⚠️^0.101.00.103.15insecure

Dev dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 futures^0.3.50.3.34up to date
 openssl^0.10.550.10.81up to date
 tokio^1.211.53.1up to date
 tracing-subscriber^0.30.3.23up to date

Security Vulnerabilities

rustls-webpki: Name constraints for URI names were incorrectly accepted

RUSTSEC-2026-0098

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-965h-392x-2mh5. Thank you to @1seal for the report.

rustls-webpki: Name constraints were accepted for certificates asserting a wildcard name

RUSTSEC-2026-0099

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.

rustls-webpki: Reachable panic in certificate revocation list parsing

RUSTSEC-2026-0104

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.