Skip to content
OpenAdvisories
High · 7.5 CVE-2026-93599 EUVD-2026-82894GHSA-82j2-j2ch-gfr8GHSA-g42g-9vm4-7gfjRUSTSEC-2026-0104

rustls-webpki before 0.103.13 Panic via empty BIT STRING

Published Sep 18, 2026 · Updated Sep 18, 2026 · Assigned by VulnCheck

Vendor: rustls Product: webpki Package: kata-containers-cc Package: rust Package: rust-afterburn Package: rust-rustls-webpki Package: rust-rustls-webpki Package: rustls-webpki Ecosystem: Azure Linux Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu

Description

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

Affected products

VendorProductAffectedFixed
rustls webpki < 0.103.13, 0.104.0-alpha.1 – < 0.104.0-alpha.7 0.103.13

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rust-rustls-webpki 0.103.13+ds-1 —
Debian 13 rust-rustls-webpki No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS rust-rustls-webpki No fix yet —
Ubuntu 24.04 LTS rust-rustls-webpki No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 goose 1.45.0-1.el10_2 RHSA-2026:80765
RHEL 10 sequoia-sq +1 1.4.0.1-4.el10_2 RHSA-2026:85848
RHEL 9 goose 1.45.0-1.el9_8 RHSA-2026:80764
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 chunkah 0.6.0-3.hum1 RHSA-2026:42825
Red Hat Hardened Images 1 netavark +3 2:2.1.0-1.hum1 RHSA-2026:57200, RHSA-2026:56999
Red Hat Hardened Images 1 openshell +2 0.0.116-0.2.hum1 RHSA-2026:70694
Red Hat Hardened Images 1 rust +18 1.98.1-1.hum1 RHSA-2026:66076

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 sequoia-sq 1.4.0.1-4.el10_2 ALSA-2026:85848

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 rust-sequoia-sq 1.4.0.1-4.el10_2 RLSA-2026:85848

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 aws-nitro-enclaves-cli 1.5.2~git0.1c496ed-150600.10.18.1 SUSE-SU-2026:5066-1
SLES 15 SP6 aws-nitro-enclaves-cli 1.5.2~git0.1c496ed-150600.10.18.1 SUSE-SU-2026:5066-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 aws-nitro-enclaves-cli 1.5.2~git0.1c496ed-160000.1.1 SUSE-SU-2026:24467-1
SLES for SAP 16.0 rustup 1.29.1~0-160000.1.1 SUSE-SU-2026:24014-1
SLES for SAP 16.0 sccache 0.18.0~2-160000.1.1 SUSE-SU-2026:23983-1
SLES 16.0 aws-nitro-enclaves-cli 1.5.2~git0.1c496ed-160000.1.1 SUSE-SU-2026:24467-1
SLES 16.0 rustup 1.29.1~0-160000.1.1 SUSE-SU-2026:24014-1
SLES 16.0 sccache 0.18.0~2-160000.1.1 SUSE-SU-2026:23983-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed aws-nitro-enclaves-cli 1.5.2~git0.1c496ed-1.1 openSUSE-SU-2026:12161-1
openSUSE Tumbleweed obs-service-cargo 7.2.2-3.1 openSUSE-SU-2026:11861-1
openSUSE Tumbleweed python-tokenizers 0.23.2-1.1 openSUSE-SU-2026:11936-1
openSUSE Tumbleweed rustup 1.29.2~0-1.1 openSUSE-SU-2026:12409-1
openSUSE Tumbleweed shadowsocks-rust 1.25.0-2.1 openSUSE-SU-2026:11976-1
openSUSE Leap 16.0 aws-nitro-enclaves-cli 1.5.2~git0.1c496ed-160000.1.1 openSUSE-SU-2026:22175-1
openSUSE Leap 16.0 rustup 1.29.1~0-160000.1.1 openSUSE-SU-2026:22016-1
openSUSE Leap 16.0 sccache 0.18.0~2-160000.1.1 openSUSE-SU-2026:21982-1
openSUSE Leap 16.0 sequoia-sq 1.5.0-bp160.1.1 openSUSE-RU-2026:22132-1
openSUSE Leap 16.0 shadowsocks-libev 3.3.6-bp160.3.1 openSUSE-SU-2026:22189-1
openSUSE Leap 16.0 shadowsocks-rust 1.25.0-bp160.1.1 openSUSE-SU-2026:22189-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-efs-utils 3.3.5-1.amzn2023 ALAS2023-2026-3378
Amazon Linux 2023 aws-workload-credentials-provider 3.1.2-1.amzn2023 ALAS2023-2026-3375
Amazon Linux 2 amazon-efs-utils 3.3.5-1.amzn2 ALAS2-2026-4069

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kata-containers-cc 3.15.0.aks0-23 —
Azure Linux 3 rust +1 No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 sequoia-sq 1.4.0.1-4.0.1.el10_2 ELSA-2026-85848

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io rustls-webpki < 0.103.13 0.103.13 GHSA-82j2-j2ch-gfr8
crates.io rustls-webpki >= 0.104.0-alpha.1, < 0.104.0-alpha.7 0.104.0-alpha.7 GHSA-82j2-j2ch-gfr8
crates.io rustls-webpki >= 0.0.0-0, < 0.103.13 · >= 0.104.0-alpha.1, < 0.104.0-alpha.7 0.103.13, 0.104.0-alpha.7 RUSTSEC-2026-0104

Advisories 29

References