Panic Vulnerability in rustls-webpki Affects Certificate Revocation Checking

CVE-2026-93599

What is CVE-2026-93599?

rustls-webpki versions up to 0.103.12 and early alpha releases before 0.104.0-alpha.7 contain a vulnerability that leads to a panic when processing specific empty BIT STRINGs. This occurs during the execution of the BorrowedCertRevocationList::from_der() function, where an improperly constructed Certificate Revocation List (CRL) triggers a panic or a denial of service, particularly when the application is set to perform CRL checks. Exploitation requires an attacker to provide manipulated CRL data. Affected versions were fixed in 0.103.13 and 0.104.0-alpha.7.

References