Reachable panic in certificate revocation list parsing
Details
Package
rustls-webpki
Version
0.102.8
Date
2026-04-22
Patched versions
>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
> Reachable panic in certificate revocation list parsing
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls-webpki` |
| Version | `0.102.8` |
| Date | 2026-04-22 |
| Patched versions | `>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7` |
A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
or [`OwnedCertRevocationList::from_der`]. This was the result of mishandling a syntactically valid empty
`BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to [@tynus3](https://github.com/tynus3) for the report.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0104.html) for additional details.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
rustls-webpki0.102.8>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7A panic was reachable when parsing certificate revocation lists via [
BorrowedCertRevocationList::from_der]or [
OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid emptyBIT STRINGappearing in theonlySomeReasonselement of aIssuingDistributionPointCRL extension.This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
See advisory page for additional details.