GHSA-pwjx-qhcg-rvj4 CVE-2026-93602 RUSTSEC-2026-0049
webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic
- Severity
- 5.9 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.20%
- Chance of exploitation in the next 30 days. Higher than 9.95% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-299 Improper Check for Certificate Revocation
- Fix
0.103.10- Upgrade rustls-webpki to this version or later
Description
If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.
The impact was that correct provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.
This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)
More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| rustls-webpki | >= 0.102.0-alpha.0, < 0.103.10 |
0.103.10 |
| rustls-webpki | >= 0.104.0-alpha.1, < 0.104.0-alpha.5 |
0.104.0-alpha.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rustls-webpki crates.io → 0.103.10
- cargo
cargo update -p rustls-webpki --precise 0.103.10
Severity breakdown
CVSS 4.0 5.9
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 4.4
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-299: Improper Check for Certificate Revocation
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
How to prevent it
- Architecture and Design: Ensure that certificates are checked for revoked status.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0382 Distrust compromised intermediate certificates in crypto/x509 | Medium | Also affects rustls-webpki |
| GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING | High | Also affects rustls-webpki |
| GHSA-xgp8-3hg3-c2mh webpki: Name constraints were accepted for certificates asserting a wildcard name | Low | Also affects rustls-webpki |
| GHSA-965h-392x-2mh5 webpki: Name constraints for URI names were incorrectly accepted | Low | Also affects rustls-webpki |
| GHSA-fh2r-99q2-6mmg rustls-webpki: CPU denial of service in certificate path building | High | Also affects rustls-webpki |
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates | High | Same weakness, CWE-299 |
| GHSA-9f94-5g5w-gf6r CRL Distribution Point Scope Check Logic Error in AWS-LC | Critical | Same weakness, CWE-299 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor