CVE-2026-93599: rustls-webpki Denial of Service Vulnerability

CVE-2026-93599 Overview

CVE-2026-93599 is a reachable panic vulnerability in rustls-webpki versions up to 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7. The flaw lives in the bit_string_flags() function inside src/der.rs. A malformed named-bit BIT STRING containing exactly [0x00] triggers an integer underflow followed by an out-of-bounds index operation. Attackers reach the code path by supplying a crafted Certificate Revocation List (CRL) with an issuingDistributionPoint extension carrying an onlySomeReasons value. The result is a denial-of-service panic in applications that parse attacker-influenced CRL bytes through BorrowedCertRevocationList::from_der(). The issue is tracked under [CWE-191: Integer Underflow].

Critical Impact
A crafted CRL parsed through the public API crashes the host process, disrupting availability for services that opt in to CRL revocation checking via RevocationOptions.

Affected Products

rustls-webpki versions up through 0.103.12
rustls-webpki0.104.0-alpha releases prior to 0.104.0-alpha.7
Downstream applications that pass RevocationOptions to verify_for_usage() with attacker-influenced CRL bytes

Discovery Timeline

2026-09-18 - CVE-2026-93599 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93599

Vulnerability Analysis

The defect is a classic integer underflow in ASN.1 BIT STRING parsing. bit_string_flags() expects the first byte of the encoded value to declare the number of unused padding bits, followed by at least one data byte. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00], which encodes zero padding bits and zero data bytes. The function then computes raw_bits.len() - 1 against an empty slice, causing a subtract-with-overflow panic in debug builds and an index-out-of-bounds panic in release builds. The panic aborts the current thread and, in most Rust server topologies, terminates the process handling the request.

Root Cause

The root cause is missing length validation before arithmetic on an untrusted slice. The parser assumes the presence of at least one payload byte after the unused-bits prefix but never enforces the invariant. Because usize arithmetic underflows silently in release mode, the subsequent slice index escapes bounds. This maps to [CWE-191] and reflects a broader class of certificate-parser bugs where malformed ASN.1 structures are accepted past the initial length check.

Attack Vector

Exploitation is network-reachable but conditional. An application must explicitly opt in to CRL revocation checking by passing RevocationOptions to verify_for_usage(). The application must also fetch or accept CRL bytes from a source the attacker can influence, such as a compromised CRL distribution point, a downgraded HTTP fetch, or a client-supplied CRL. The default rustls configuration does not use RevocationOptions and is therefore unaffected. When the preconditions are met, the attacker delivers a CRL whose issuingDistributionPoint extension contains an onlySomeReasons value encoded as an empty named-bit BIT STRING. Parsing that extension through BorrowedCertRevocationList::from_der() triggers the panic and denies service.

See the GitHub Security Advisory GHSA-82j2-j2ch-gfr8 and the VulnCheck Advisory for Rustls WebPKI for the underlying analysis.

Detection Methods for CVE-2026-93599

Indicators of Compromise

Unexpected process aborts or thread panics in services that perform TLS verification with CRL checking enabled.
Log entries referencing bit_string_flags, raw_bits, or subtract with overflow originating from rustls-webpki.
Repeated fetches of a CRL from an untrusted or newly-observed distribution point immediately preceding a crash.

Detection Strategies

Inventory Rust binaries and container images for rustls-webpki versions at or below 0.103.12 using software bill of materials (SBOM) tooling such as cargo audit or syft.
Instrument affected services with panic hooks that emit structured telemetry, then correlate panic events with inbound CRL parsing operations.
Alert on repeated crashes of the same TLS-terminating service within short intervals, which is characteristic of DoS abuse.

Monitoring Recommendations

Forward application stdout, stderr, and systemd journal entries into a centralized logging pipeline to capture panic backtraces.
Monitor CRL distribution point responses for anomalous size, unexpected content types, or unusual issuingDistributionPoint extensions.
Track process restart counts and availability metrics for services that call verify_for_usage() with RevocationOptions.

How to Mitigate CVE-2026-93599

Immediate Actions Required

Upgrade rustls-webpki to 0.103.13 or 0.104.0-alpha.7 across all Rust projects and rebuild affected binaries and container images.
Audit application code for callers of verify_for_usage() that pass RevocationOptions and confirm the source of CRL bytes.
Restrict CRL fetching to trusted, authenticated distribution points where feasible.

Patch Information

The rustls maintainers fixed the underflow in rustls-webpki0.103.13 and 0.104.0-alpha.7. Update the Cargo.toml dependency constraint and run cargo update -p rustls-webpki to pull the patched crate. Rebuild and redeploy every downstream artifact that statically links the affected version. Additional context is available in GHSA-82j2-j2ch-gfr8.

Workarounds

Disable CRL revocation checking by removing RevocationOptions from verify_for_usage() calls until the patched crate is deployed.
Validate CRL byte length and reject responses that fail sanity checks before passing them to BorrowedCertRevocationList::from_der().
Pin CRL retrieval to internally controlled mirrors that pre-validate CRL structure with a hardened parser.

bash

# Update rustls-webpki to the patched release
cargo update -p rustls-webpki --precise 0.103.13
cargo audit
cargo build --release