rustls-webpki before 0.103.13 Panic via empty BIT STRING

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-93599 · CVE overview and exploitation status

EUVD-2026-82894

GHSA-g42g-9vm4-7gfj

GHSA-82j2-j2ch-gfr8

RUSTSEC-2026-0104

cve-program · CVE-2026-93599

• https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8
• https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string

euvd · EUVD-2026-82894

• https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8
• https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string

nvd · CVE-2026-93599

• https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8
• https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string

osv · GHSA-82j2-j2ch-gfr8

• https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8
• https://github.com/rustls/webpki
• https://rustsec.org/advisories/RUSTSEC-2026-0104.html

osv · RUSTSEC-2026-0104

• https://crates.io/crates/rustls-webpki
• https://rustsec.org/advisories/RUSTSEC-2026-0104.html

• rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero … · Advisory content revised · 7 Nov 2026
• rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero … · Advisory content revised · 5 Nov 2026
• rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero … · Advisory content revised · 1 Nov 2026