RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.2k
- Forks
- 232
- Avg merge
- 11h 35m
- Merged PRs (30d)
- 60
Description
Reachable panic in certificate revocation list parsing
| Details | |
|---|---|
| Package | rustls-webpki |
| Version | 0.103.12 |
| Date | 2026-04-22 |
| Patched versions | >=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7 |
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty
BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
See advisory page for additional details.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked RustSec advisory page and the reported rustls-webpki version and parsing entry points. The issue does not identify a docs.rs file, test, or requested repository change, so first determine what action docs.rs is expected to take and how completion would be verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100