CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain a faulty CRL revocation-checking logic: the authority-matching compares only the first distributionPoint against each CRL's IssuingDistributionPoint , ignoring additional distributionPoints. An attacker who controls a compromised ...

EUVD-2026-82894

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...