CVE-2026-93602

A flaw was found in rustls-webpki. The component contains faulty Certificate Revocation List CRL authority-matching logic, which incorrectly compares only the first distribution point against each CRL's issuing distribution point, ignoring others. This vulnerability allows an attacker with a...

CVE-2026-93602: Improper Check for Certificate Revocation

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...