CVE-2026-93602: rustls-webpki CRL distribution point matching bypass

CVE-2026-93602 · Severity: medium · CVSS 4.4 · Published 2026-09-18

rustls-webpki is a certificate validation library used in Rust applications to verify that SSL/TLS certificates are legitimate and not revoked. The library contains a flaw in its revocation checking logic that causes it to ignore multiple revocation distribution points in a certificate, checking only the first one. An attacker who has compromised a trusted certificate authority could exploit this to use revoked certificates that should be blocked, potentially enabling credential theft or man-in-the-middle attacks.

Technologies: rustls-webpki (crates.io), Rustls Webpki. Vendors: crates.io, Rustls.

Quick answers

Is CVE-2026-93602 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93602 being exploited in the wild.
How severe is CVE-2026-93602?
Medium severity, with a CVSS score of 4.4, published 18 September 2026.
Which products and versions are affected?
rustls-webpki (crates.io) SEMVER:introduced=0.102.0-alpha.0,fixed=0.103.10; Rustls Webpki >=0.101.0, <0.103.10 or >=0.104.0-alpha.1, <0.104.0-alpha.5.
Is there a fix for CVE-2026-93602?
Yes. rustls-webpki (crates.io): upgrade to 0.103.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93602 attacked?
It is attacked over the network.
Am I affected by CVE-2026-93602?
Check whether you run rustls-webpki (crates.io) or Rustls Webpki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rustls-webpki (crates.io): upgrade to 0.103.10 or later
    cargo update -p rustls-webpki

Technical details

rustls-webpki's CRL (Certificate Revocation List) validation logic fails to properly match multiple distribution points in X.509 certificates. When a certificate specifies multiple distributionPoint values, only the first is compared against each CRL's IssuingDistributionPoint; subsequent distribution points are ignored. This is a CWE-299 improper certificate revocation check. The vulnerability requires an attacker to have compromised a trusted issuing certificate authority to craft a malicious certificate and corresponding CRL. Under the permissive UnknownStatusPolicy::Allow policy, revoked certificates will be incorrectly accepted; under the default deny policy, legitimate certificates may be rejected with spurious revocation status errors. Patches are available in rustls-webpki 0.103.10 and 0.104.0-alpha.5 or later.

Affected products

  • rustls webpki >=0.101.0, <0.103.10 or >=0.104.0-alpha.1, <0.104.0-alpha.5

Identifiers

  • CVE-2026-93602
  • GHSA-pwjx-qhcg-rvj4
  • RUSTSEC-2026-0049

Timeline

  • 2026-03-20: disclosed
  • 2026-09-18: advisory
  • 2026-03-20: patched: patches released in 0.103.10 and 0.104.0-alpha.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.