CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain a faulty CRL revocation-checking logic: the authority-matching compares only the first distributionPoint against each CRL's IssuingDistributionPoint , ignoring additional distributionPoints. An attacker who controls a compromised ...