rustup 1.29.2 updates rustls-webpki to distrust eMudhra keys

The rustup team released rustup 1.29.2 on October 20, 2026. The release only updates the rustls-webpki and webpki-root-certs dependencies to deal with the eMudhra intermediate certificate problem tracked as CVE-2026-111943 and RUSTSEC-2026-0382. Anyone who installs Rust toolchains with rustup should run rustup self update, and teams that ship their own rustls-based binaries should check their lockfiles too.

What changed in rustup 1.29.2

The announcement calls this "a small release which only updates the rustls-webpki and webpki-root-certs dependencies". There are no new features, flags or behaviour changes in the CLI. The release comes about two months after rustup 1.29.1, which added parallel update checks and warnings about implicit toolchain installs (our coverage).

The RustSec advisory gives the details:

According to the advisory, affected versions "may accept certificate paths containing distrusted emSign intermediate public keys" when the configured trust anchors allow such paths. It also says the private keys for these intermediates "are now well known". rustls-webpki 0.103.16 and 0.104.0-alpha.8 reject any path that contains one of these public keys. The upstream PR has the title "reject cert paths containing distrusted SPKIs" (subject public key info). It backports the fix to the 0.103 release line.

Who is affected and why it matters

rustup downloads toolchains, components and its own updates over HTTPS. Its default download backend is reqwest with rustls, and server certificates are checked with rustls-platform-verifier. Since 1.29.0, rustup has also statically bundled the trust anchors it needs (rustup PR #4631). That is why both rustls-webpki and webpki-root-certs had to change. An older rustup could accept a certificate chain that runs through one of the distrusted intermediates. Because the private keys are public, someone able to intercept traffic could build such a chain.

This affects:

• Developer machines running rustup 1.29.1 or earlier.
• CI runners and Docker images with rustup baked in. Since rustup 1.28.0 (PR #3907), automatic self-update is turned off when the CI environment variable is set. On those hosts, rustup update updates toolchains but leaves rustup itself at the old version.
• Your own Rust services and tools that depend on rustls-webpki through rustls, reqwest, hyper-rustls or similar crates. Updating rustup does not change your project's Cargo.lock. Each project needs its own dependency update.

The same flaw has prompted fixes in other Rust-based tools. Pull requests in Deno and dprint, which both reference the upstream webpki PR, distrust the eMudhra certificates.

What to do now

The commands below come from the rustup 1.29.2 announcement, the rustup changelog and standard Cargo usage.

1. Close programs that may be using rustup, such as your IDE. Then update rustup itself:

$ rustup self update

2. Or run a normal toolchain update. Outside CI, rustup updates itself at the end:

$ rustup update

3. Check the version. It should report 1.29.2:

$ rustup --version

4. In CI images and Dockerfiles, call rustup self update explicitly, because self-update is off when CI is set. If you pin the rustup version, rustup 1.28.2 and later accept the RUSTUP_VERSION environment variable:

RUSTUP_VERSION=1.29.2 rustup self update

5. If your rustup came from an OS package manager rather than rustup-init, update it through that package manager instead.

6. For your own projects, find out which rustls-webpki version you lock and move to a patched one:

cargo tree -i rustls-webpki
cargo update -p rustls-webpki

If more than one version of the crate is in the graph, cargo update asks you to pick one with -p rustls-webpki@<version>. If you use the 0.104 alpha line, you need 0.104.0-alpha.8 or later.

7. Run cargo audit (from the RustSec cargo-audit tool) in CI so that RUSTSEC-2026-0382 fails the build until the lockfile is fixed.

Other RustSec advisories came out the same week, including RUSTSEC-2026-0384 for tokio and two wasmtime-wasi-http advisories (RUSTSEC-2026-0375 and RUSTSEC-2026-0377). A single cargo audit run will report them alongside this one.

Caveats

The rustup team warns that anti-malware scanners may block a new rustup release or stop it from creating or copying files. This happens most often while installing rust-docs, which contains many small files. The team expects such problems to clear up within a few weeks, once scanners learn about the new binary. The rustup announcement refers to "eMudhra" intermediates and the RustSec advisory to "emSign" intermediates. Both names point to the same set of distrusted keys.