EUVD-2026-82894
GHSA-g42g-9vm4-7gfj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote attacker-supplied CRL, no auth or interaction, crafting the trigger is trivial (AC:L); impact is a process-crash DoS only, so C:N/I:N/A:H (yields 7.5, below the vendor's 8.7).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.
AnalysisAI
Denial of service in rustls-webpki through 0.103.12 and in 0.104.0-alpha.1 through 0.104.0-alpha.6: a crafted certificate revocation list carrying an issuingDistributionPoint extension whose onlySomeReasons BIT STRING content is exactly [0x00] triggers an integer underflow in bit_string_flags() and panics the parsing process. Unauthenticated remote attackers can reach this only where an application has explicitly opted into CRL revocation checking by passing RevocationOptions to verify_for_usage() and parses CRL bytes from a source the attacker can influence (for example an attacker-supplied or MITM'd CRL distribution point); the default rustls configuration that omits RevocationOptions is unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the application must explicitly opt into CRL revocation checking by passing RevocationOptions to verify_for_usage() - the default rustls configuration does NOT use RevocationOptions and is unaffected; (2) the application must parse CRL bytes obtained from a source the attacker can influence (attacker-supplied or MITM'd CRL distribution point); (3) the crafted CRL must carry an issuingDistributionPoint extension whose onlySomeReasons named-bit BIT STRING content is exactly [0x00] (zero padding bits, no data bytes). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (VA:H, PR:N, UI:N) is driven purely by an availability impact with no confidentiality or integrity effect (VC:N/VI:N/VA:H) - this is a pure denial-of-service panic, not code execution, so the raw score overstates real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to rustls-webpki 0.103.13 (stable line) or 0.104.0-alpha.7 (alpha line), which fix the empty-BIT-STRING underflow in bit_string_flags(); the fix is documented in GHSA-82j2-j2ch-gfr8 (https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8) and the VulnCheck advisory (https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications that depend on rustls-webpki and determine whether they pass RevocationOptions to verify_for_usage(); for those that do, temporarily disable CRL revocation checking or restrict CRL distribution points to trusted sources to reduce exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no auth
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contai
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. Rated medium severity (C
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. Rated med
Same weakness CWE-191 – Integer Underflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today