RUSTSEC-2026-0049: CRLs not considered authoritative by Distribution Point due to faulty matching logic

What to do

1. See which version you have: cargo tree -i rustls-webpki (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rustls-webpki. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rustls-webpki = "0.103.10") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correctly provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified as GHSA-pwjx-qhcg-rvj4. Thank you to @1seal for the report.

References

• Package: crates.io/crates/rustls-webpki
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0049.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rustls-webpki

• Vulnerability HighRUSTSEC-2023-0053 · 2023-08-22rustls-webpki: CPU denial of service in certificate path building
• VulnerabilityRUSTSEC-2026-0098 · 2026-04-14Name constraints for URI names were incorrectly accepted
• VulnerabilityRUSTSEC-2026-0099 · 2026-04-14Name constraints were accepted for certificates asserting a wildcard name
• VulnerabilityRUSTSEC-2026-0104 · 2026-04-22Reachable panic in certificate revocation list parsing
• VulnerabilityRUSTSEC-2026-0382 · 2026-10-20Certificate verification may accept distrusted intermediates

Full security history of rustls-webpki