RUSTSEC-2026-0104

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0104

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0104.json

JSON Data

https://api.test.osv.dev/v1/vulns/RUSTSEC-2026-0104

Aliases

GHSA-82j2-j2ch-gfr8

Published

2026-04-22T12:00:00Z

Modified

2026-04-22T09:06:18.266404Z

Summary

Reachable panic in certificate revocation list parsing

Details

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / rustls-webpki

Package

Name: rustls-webpki; View open source insights on deps.dev
Purl: pkg:cargo/rustls-webpki

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.103.13

Introduced

0.104.0-alpha.1

Fixed

0.104.0-alpha.7

Ecosystem specific

{
    "affects": {
        "arch": [],
        "os": [],
        "functions": []
    },
    "affected_functions": null
}