CVE-2026-93602: Rustls Webpki

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.

Affected products

• Rustls Webpki: from 0.102.0-alpha.0, before 0.103.10 (fixed in 0.103.10); from 0.104.0-alpha.1, before 0.104.0-alpha.5 (fixed in 0.104.0-alpha.5)

Published 2026-09-18. Last modified 2026-09-22.