RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing #12

Closed
opened 2026-08-26 03:17:54 +00:00 by gitea-actions · 0 comments

Reachable panic in certificate revocation list parsing

Details
Package rustls-webpki
Version 0.102.8
Date 2026-04-22
Patched versions >=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty
BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

See advisory page for additional details.

> Reachable panic in certificate revocation list parsing | Details | | | ------------------- | ---------------------------------------------- | | Package | `rustls-webpki` | | Version | `0.102.8` | | Date | 2026-04-22 | | Patched versions | `>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7` | A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`] or [`OwnedCertRevocationList::from_der`]. This was the result of mishandling a syntactically valid empty `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension. This panic is reachable prior to a CRL&#39;s signature being verified. Applications that do not use CRLs are not affected. Thank you to [@tynus3](https://github.com/tynus3) for the report. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0104.html) for additional details.
Sign in to join this conversation.
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Dreaded_X/automation_rs#12