RUSTSEC-2026-0104
NoneCVSS
—
EPSS
—
Published
Apr 22, 2026
CISA due date
—
The record
Reachable panic in certificate revocation list parsing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | rustls-webpki | 0 | 0.103.13 |
| crates.io | rustls-webpki | 0.0.0-0 | 0.103.13 |
| crates.io | rustls-webpki | 0.104.0-alpha.1 | 0.104.0-alpha.7 |
Related vulnerabilities
- RUSTSEC-2026-0098 Name constraints for URI names were incorrectly accepted Also affects rustls-webpki
- RUSTSEC-2026-0099 Name constraints were accepted for certificates asserting a wildcard name Also affects rustls-webpki
- RUSTSEC-2026-0049 CRLs not considered authoritative by Distribution Point due to faulty matching logic Also affects rustls-webpki