CVE-2026-93599

rustls-webpki (Rust TLS cryptography library) versions through 0.103.12 and 0.104.0-alpha.6 are affected by a panic in bit_string_flags() in src/der.rs. The root cause is that the input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits, no data bytes)...