Debian Rust Security Tracker 🩺🦀

RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing

1 affected
Crate
rustls-webpki
Patched Versions
>=0.103.13, <0.104.0-alpha.1
>=0.104.0-alpha.7
Debian Version
0.103.15+ds-1
0.101.7-7
Debian Bugs
—
Issued
2026-04-22
Aliases
CVE-2026-93599
GHSA-82j2-j2ch-gfr8
Patched:Affected

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

Affected Packages

affected ⚠️ librust-rustls-webpki-0.101-dev 0.101.7-7