RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing

> Reachable panic in certificate revocation list parsing

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls-webpki` |
| Version | `0.101.7` |
| Date | 2026-04-22 |
| Patched versions | `>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7` |

A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
or [`OwnedCertRevocationList::from_der`]. This was the result of mishandling a syntactically valid empty
`BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0104.html) for additional details.

The advisory names the BorrowedCertRevocationList::from_der and OwnedCertRevocationList::from_der entry points, but no repository file or test is specified. Start by reviewing how the project tracks its rustls-webpki version and the linked advisory, then verify that the affected dependency is updated to a patched version and the reachable panic is covered before considering this complete.

Written by the indexing model from the issue text.