RUSTSEC-2026-0104None▾ SunlitReachable panic in certificate revocation list parsing
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty
BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.7Upgrade to a patched release:
rustls-webpki 0.104.0-alpha.7Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0099NoneName constraints were accepted for certificates asserting a wildcard name
RUSTSEC-2026-0098NoneName constraints for URI names were incorrectly accepted
RUSTSEC-2026-0049NoneCRLs not considered authoritative by Distribution Point due to faulty matching logic