Skip to content
OpenAdvisories

Package · crates.io

rustls-webpki

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-93599

    rustls-webpki before 0.103.13 Panic via empty BIT STRING

    rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no…

    rustls webpki rust kata-containers-cc Debian Ubuntu Azure Linux crates.io
  • High 7.5
    GHSA-fh2r-99q2-6mmg

    rustls-webpki: CPU denial of service in certificate path building

    When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. We…

    rustls-webpki crates.io