---
id: RUSTSEC-2026-0104
aliases:
  - GHSA-82j2-j2ch-gfr8
title: Reachable panic in certificate revocation list parsing
summary: Reachable panic in certificate revocation list parsing
severity: none
vendor: rustls-webpki
product: rustls-webpki
ecosystem: rust
affected:
  - 'rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.7'
patched:
  - rustls-webpki 0.104.0-alpha.7
published: '2026-04-22'
updated: '2026-07-17'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0104'
references:
  - url: 'https://crates.io/crates/rustls-webpki'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0104.html'
tags:
  - osv
  - rust
ingestedAt: '2026-07-17T19:00:51.986Z'
---

## Overview

A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
`BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to [@tynus3](https://github.com/tynus3) for the report.

## Affected packages

- `rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.7`

## Remediation

Upgrade to a patched release:

- `rustls-webpki 0.104.0-alpha.7`