RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing

What to do

1. See which version you have: cargo tree -i rustls-webpki (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rustls-webpki. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rustls-webpki = "0.104.0-alpha.7") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

References

• Package: crates.io/crates/rustls-webpki
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0104.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rustls-webpki

• Vulnerability HighRUSTSEC-2023-0053 · 2023-08-22rustls-webpki: CPU denial of service in certificate path building
• VulnerabilityRUSTSEC-2026-0049 · 2026-03-20CRLs not considered authoritative by Distribution Point due to faulty matching logic
• VulnerabilityRUSTSEC-2026-0098 · 2026-04-14Name constraints for URI names were incorrectly accepted
• VulnerabilityRUSTSEC-2026-0099 · 2026-04-14Name constraints were accepted for certificates asserting a wildcard name
• VulnerabilityRUSTSEC-2026-0382 · 2026-10-20Certificate verification may accept distrusted intermediates

Full security history of rustls-webpki