PkgSeer

Vulnerability RUSTSEC-2026-0104

Unknown

6 months ago

Reachable panic in certificate revocation list parsing

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6

Summary

Reachable panic in certificate revocation list parsing

Details

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Certificate verification may accept distrusted intermediates

0.0.0-invalid - 0.103.15 and 0.104.0-alpha.1 - 0.104.0-alpha.7 RUSTSEC-2026-0382

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

0.0.0-invalid - 0.103.12 and 0.104.0-alpha.1 - 0.104.0-alpha.6 GHSA-82j2-j2ch-gfr8

webpki: Name constraints were accepted for certificates asserting a wildcard name

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-xgp8-3hg3-c2mh

webpki: Name constraints for URI names were incorrectly accepted

0.101.0 - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 GHSA-965h-392x-2mh5

Name constraints for URI names were incorrectly accepted

0.0.0-invalid - 0.103.11 and 0.104.0-alpha.1 - 0.104.0-alpha.5 RUSTSEC-2026-0098

View all vulnerabilities for these packages

Impacted packages

rustls-webpki

Timeline

Published

6 months ago

Fixed (0.104.0-alpha.7)

6 months ago

Fixed (0.103.13)

6 months ago

Last Modified

1 month ago