# CVE-2026-93602: rustls-webpki CRL distribution point matching bypass

Source: https://junglewise.ai/threats/cve-2026-93602-rustls-webpki-crl-distribution-point-matching-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93602 · Severity: medium · CVSS 4.4 · Published 2026-09-18

rustls-webpki is a certificate validation library used in Rust applications to verify that SSL/TLS certificates are legitimate and not revoked. The library contains a flaw in its revocation checking logic that causes it to ignore multiple revocation distribution points in a certificate, checking only the first one. An attacker who has compromised a trusted certificate authority could exploit this to use revoked certificates that should be blocked, potentially enabling credential theft or man-in-the-middle attacks.

Technologies: [rustls-webpki (crates.io)](https://junglewise.ai/threats/technologies/rustls-webpki), [Rustls Webpki](https://junglewise.ai/threats/technologies/webpki). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Rustls](https://junglewise.ai/threats/vendors/rustls).

## Quick answers

**Is CVE-2026-93602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93602 being exploited in the wild.

**How severe is CVE-2026-93602?** Medium severity, with a CVSS score of 4.4, published 18 September 2026.

**Which products and versions are affected?** rustls-webpki (crates.io) SEMVER:introduced=0.102.0-alpha.0,fixed=0.103.10; Rustls Webpki >=0.101.0, <0.103.10 or >=0.104.0-alpha.1, <0.104.0-alpha.5.

**Is there a fix for CVE-2026-93602?** Yes. rustls-webpki (crates.io): upgrade to 0.103.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93602 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-93602?** Check whether you run rustls-webpki (crates.io) or Rustls Webpki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rustls-webpki (crates.io): upgrade to 0.103.10 or later

  ```sh
  cargo update -p rustls-webpki
  ```


## Technical details

rustls-webpki's CRL (Certificate Revocation List) validation logic fails to properly match multiple distribution points in X.509 certificates. When a certificate specifies multiple distributionPoint values, only the first is compared against each CRL's IssuingDistributionPoint; subsequent distribution points are ignored. This is a CWE-299 improper certificate revocation check. The vulnerability requires an attacker to have compromised a trusted issuing certificate authority to craft a malicious certificate and corresponding CRL. Under the permissive UnknownStatusPolicy::Allow policy, revoked certificates will be incorrectly accepted; under the default deny policy, legitimate certificates may be rejected with spurious revocation status errors. Patches are available in rustls-webpki 0.103.10 and 0.104.0-alpha.5 or later.

## Affected products

- rustls webpki >=0.101.0, <0.103.10 or >=0.104.0-alpha.1, <0.104.0-alpha.5

## Identifiers

- CVE-2026-93602
- GHSA-pwjx-qhcg-rvj4
- RUSTSEC-2026-0049

## Timeline

- 2026-03-20: disclosed
- 2026-09-18: advisory
- 2026-03-20: patched: patches released in 0.103.10 and 0.104.0-alpha.5

## References

- [https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4](https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4)
- [https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.10-crl-revocation-check-bypass](https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.10-crl-revocation-check-bypass)

## Related threats

- [Go crypto/x509 untrusted intermediate certificate validation](https://junglewise.ai/threats/cve-2026-111943-on-most-platforms-go-uses-the-given-system-root-certificates)
- [rustls-webpki name constraint bypass for wildcard certificates](https://junglewise.ai/threats/cve-2026-93601-rustls-webpki-name-constraint-bypass-for-wildcard-certificates)
- [rustls-webpki X.509 name constraint bypass for URI names](https://junglewise.ai/threats/cve-2026-93600-rustls-webpki-x-509-name-constraint-bypass-for-uri-names)
- [rustls-webpki integer underflow in BIT STRING parsing](https://junglewise.ai/threats/cve-2026-93599-rustls-webpki-integer-underflow-in-bit-string-parsing)
- [rustls-webpki: CPU denial of service in certificate path building](https://junglewise.ai/threats/rustls-webpki-cpu-denial-of-service-in-certificate-path-building-3f07ea21)