CRL Revocation Check Bypass in rustls-webpki Affected by Faulty Authority-Matching Logic

CVE-2026-93602

What is CVE-2026-93602?

The rustls-webpki library has a security issue due to a flaw in its Certificate Revocation List (CRL) authority-matching logic. Versions prior to 0.103.10 and 0.104.0-alpha.5 can improperly evaluate revocation checks by only considering the initial distributionPoint against each CRL's IssuingDistributionPoint. This oversight allows malicious actors with control over a trusted issuing authority to exploit the system by presenting revoked certificates that may erroneously pass revocation checks. Under the UnknownStatusPolicy::Allow, vulnerable systems may not flag these revocations correctly and could either fail to alert on known threats or provide misleading error responses under the default deny policy.

References