rustls-webpki before 0.103.10 CRL Revocation Check Bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-93602 · CVE overview and exploitation status

EUVD-2026-82897

GHSA-8hrm-p5h4-6vcx

GHSA-pwjx-qhcg-rvj4

RUSTSEC-2026-0049

cve-program · CVE-2026-93602

• https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4
• https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.10-crl-revocation-check-bypass

euvd · EUVD-2026-82897

• https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4
• https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.10-crl-revocation-check-bypass

nvd · CVE-2026-93602

• https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4
• https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.10-crl-revocation-check-bypass

osv · GHSA-pwjx-qhcg-rvj4

• https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4
• https://github.com/rustls/webpki
• https://rustsec.org/advisories/RUSTSEC-2026-0049.html

osv · RUSTSEC-2026-0049

• https://crates.io/crates/rustls-webpki
• https://rustsec.org/advisories/RUSTSEC-2026-0049.html

• rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attac… · Advisory content revised · 5 Nov 2026
• rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attac… · Advisory content revised · 1 Nov 2026