{"id":"RUSTSEC-2026-0104","aliases":["GHSA-82j2-j2ch-gfr8"],"title":"Reachable panic in certificate revocation list parsing","summary":"Reachable panic in certificate revocation list parsing","severity":"none","vendor":"rustls-webpki","product":"rustls-webpki","ecosystem":"rust","affected":["rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.7"],"patched":["rustls-webpki 0.104.0-alpha.7"],"published":"2026-04-22","updated":"2026-07-17","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0104","references":[{"url":"https://crates.io/crates/rustls-webpki"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0104.html"}],"tags":["osv","rust"],"ingestedAt":"2026-07-17T19:00:51.986Z","slug":"RUSTSEC-2026-0104","body":"## Overview\n\nA panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]\nor [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty\n`BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.\n\nThis panic is reachable prior to a CRL's signature being verified.\n\nApplications that do not use CRLs are not affected.\n\nThank you to [@tynus3](https://github.com/tynus3) for the report.\n\n## Affected packages\n\n- `rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rustls-webpki 0.104.0-alpha.7`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}