Reachable panic in certificate revocation list parsing
| Details |
|
| Package |
rustls-webpki |
| Version |
0.103.12 |
| Date |
2026-04-22 |
| Patched versions |
>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7 |
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty
BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
See advisory page for additional details.
rustls-webpki0.103.12>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7A panic was reachable when parsing certificate revocation lists via [
BorrowedCertRevocationList::from_der]or [
OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid emptyBIT STRINGappearing in theonlySomeReasonselement of aIssuingDistributionPointCRL extension.This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
See advisory page for additional details.