Skip to content
Fencer Intel
high 7.5

CVE-2026-93599 json

rustls-webpki before 0.103.13 Panic via empty BIT STRING

published 6mo ago modified last mo. also GHSA-82j2-j2ch-gfr8 , RUSTSEC-2026-0104 , EUVD-2026-82894

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

Patch / fix

  • crates.io rustls-webpki 0.103.13, 0.104.0-alpha.7
  • rustls webpki 0.103.13, 0.104.0-alpha.7
  • rust-rustls-webpki Debian 14 0.103.13+ds-1

debian advisories DEBIAN-CVE-2026-93599

  • rust-sequoia-sq RHEL 10.2 1.4.0.1-4.el10_2
  • sequoia-sq RHEL 10.2 1.4.0.1-4.el10_2
  • goose RHEL 10.2 1.45.0-1.el10_2
  • goose RHEL 9 1.45.0-1.el9_8
  • openshell hummingbird 1 0.0.116-0.2.hum1
  • openshell-gateway hummingbird 1 0.0.116-0.2.hum1
  • python3-openshell hummingbird 1 0.0.116-0.2.hum1
  • rust hummingbird 1 1.98.1-1.hum1

red hat advisories RHSA-2026:85848RHSA-2026:80765RHSA-2026:80764RHSA-2026:70694RHSA-2026:66076RHSA-2026:57200

  • aws-nitro-enclaves-cli SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6 1.5.2~git0.1c496ed-150600.10.18.1
  • aws-nitro-enclaves-cli SLES for SAP applications 16.0, SLES 16.0 1.5.2~git0.1c496ed-160000.1.1
  • rustup SLES for SAP applications 16.0, SLES 16.0 1.29.1~0-160000.1.1
  • sccache SLES for SAP applications 16.0, SLES 16.0 0.18.0~2-160000.1.1

suse advisories SUSE-SU-2026:5066-1SUSE-SU-2026:24467-1SUSE-SU-2026:24014-1SUSE-SU-2026:23983-1

  • rustup openSUSE Tumbleweed 1.29.2~0-1.1
  • aws-nitro-enclaves-cli openSUSE Leap 16.0 1.5.2~git0.1c496ed-160000.1.1
  • shadowsocks-libev openSUSE Leap 16.0 3.3.6-bp160.3.1
  • shadowsocks-rust openSUSE Leap 16.0 1.25.0-bp160.1.1
  • sequoia-sq openSUSE Leap 16.0 1.5.0-bp160.1.1
  • aws-nitro-enclaves-cli openSUSE Tumbleweed 1.5.2~git0.1c496ed-1.1
  • rustup openSUSE Leap 16.0 1.29.1~0-160000.1.1
  • shadowsocks-rust openSUSE Tumbleweed 1.25.0-2.1

opensuse advisories openSUSE-SU-2026:12409-1openSUSE-SU-2026:22175-1openSUSE-SU-2026:22189-1openSUSE-RU-2026:22132-1openSUSE-SU-2026:12161-1openSUSE-SU-2026:22016-1

  • sequoia-sq AlmaLinux 10 1.4.0.1-4.el10_2

almalinux advisories ALSA-2026:85848

  • rust-sequoia-sq Rocky Linux 10 1.4.0.1-4.el10_2

rocky linux advisories RLSA-2026:85848

  • kata-containers-cc Azure Linux 3.0 3.15.0.aks0-23

azure linux advisories AZL-103469

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-93599 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-93599 updated cvss 7.5

rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List

  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-backend-rhel9 Red Hat Confidential Cluster Operator confidential-clusters-beta/compute-pcrs-rhel9, confidential-clusters-beta/registration-server-rhel9, confidential-clusters-beta/attestation-key-register-rhel9, confidential-clusters-beta/confidential-cluster-rhel9-operator, confidential-clusters-beta/confidential-cluster-operator-bundle
    affected: no fix available
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9, openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/controller-rhel9, ansible-automation-platform-26/de-minimal-rhel9, ansible-automation-platform-27/controller-rhel9, ansible-automation-platform-27/de-minimal-rhel9, ansible-automation-platform-26/eda-controller-rhel9, ansible-automation-platform-27/eda-controller-rhel9, +1 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 rpm-ostree, rpm-ostree-libs, rpm-ostree 2026.2-2.el10_2, clevis-pin-trustee 0.1.0-4.el10 Red Hat Enterprise Linux 10 trustee 0.15.0-2.el10, rpm-ostree 2026.2-2.el10_2, rust-coreos-installer 0.26.0-1.el10_2 Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.98.1-1.el10 Red Hat OpenShift AI (RHOAI) rhai/base-image-torch-2.14-cpu-rhel9, rhai/base-image-torch-2.14-cuda-13.0-rhel9, rhoai/odh-ml-pipelines-runtime-generic-rhel9 Red Hat Satellite 6 python-maturin 1.8.2-1.el9pc, python3.12-maturin 1.7.1-2.el9sat, satellite/iop-advisor-engine-rhel9
    affected: no fix available
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-chatbot-rhel9 1791978798
    fixed: vendor fix RHSA-2026:87120
  • Red Hat Enterprise Linux AppStream (v. 10) sequoia-sq 1.4.0.1-4.el10_2, rust-sequoia-sq 1.4.0.1-4.el10_2
    fixed: vendor fix RHSA-2026:85848
  • Red Hat Enterprise Linux Extensions Channel (v. 9) goose 1.45.0-1.el9_8
    fixed: vendor fix RHSA-2026:80764
show 16 more
  • Red Hat Enterprise Linux Extensions Channel (v. 10) goose 1.45.0-1.el10_2
    fixed: vendor fix RHSA-2026:80765
  • Red Hat Hardened Images rust 1.98.1-1.hum1, cargo 1.98.1-1.hum1, chunkah 0.6.0-3.hum1, clippy 1.98.1-1.hum1, netavark 2.1.0-1.hum1, rustfmt 1.98.1-1.hum1, +19 more
    fixed: vendor fix RHSA-2026:56999
  • Red Hat OpenShift AI 2.25 rhoai/odh-model-registry-job-async-upload-rhel9 1791865093
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-fms-guardrails-orchestrator-rhel9 1791862392, rhoai/odh-model-registry-job-async-upload-rhel9 1791870571
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift AI 3.5 rhoai/odh-feature-server-rhel9 1791864484
    fixed: vendor fix RHSA-2026:86891
  • Red Hat Satellite 6.18 satellite/iop-vmaas-rhel9 1793197689, satellite/iop-host-inventory-rhel9 1793248583, satellite/iop-advisor-backend-rhel9 1793154626, satellite/iop-vulnerability-engine-rhel9 1793014224
    fixed: vendor fix RHSA-2026:92628
  • Red Hat Satellite 6.19 satellite/iop-vmaas-rhel9 1793197872, satellite/iop-host-inventory-rhel9 1793248689, satellite/iop-advisor-backend-rhel9 1793175529, satellite/iop-vulnerability-engine-rhel9 1793003717
    fixed: vendor fix RHSA-2026:92595
  • Red Hat Trusted Artifact Signer 1.4 rhtas/tuffer-rhel9 1791809629, rhtas/tuftool-rhel9 1791809629
    fixed: vendor fix RHSA-2026:83603
  • Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9, agent-sandbox/agent-sandbox-router, openshift-sandboxed-containers/osc-podvm-builder-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-dotnet-external-provider-rhel9
    not affected: vulnerable code not present
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-ztunnel-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9
    not affected: component not present
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9, ansible-automation-platform-26/mcp-tools-rhel9, ansible-automation-platform-27/mcp-tools-rhel9, +16 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1791947385, ansible-automation-platform-26/gateway-rhel9 1791971533, ansible-automation-platform-26/hub-web-rhel9 1791952205, ansible-automation-platform-26/receptor-rhel9 1791968536, ansible-automation-platform-26/mcp-tools-rhel9 1791941340, ansible-automation-platform-26/controller-rhel9 1791947602, +24 more Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9
    not affected: vulnerable code not present
  • Red Hat Discovery 2 discovery/discovery-server-rhel9 Red Hat Enterprise Linux 7 firefox, firefox 140.16.0-1.el10_2 Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, rustfmt, rust-gdb, +10 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 ctdb, rust, cargo, samba, clippy, libldb, +68 more
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat Enterprise Linux 10 mesa 26.1.1-2.el10, rust 1.98.1-1.el10, samba 4.23.5-110.el10_2, firefox 140.16.0-1.el10_2, rust-afterburn 5.10.0-1.el10, virt-firmware-rs 26.4-1.el10, +3 more Red Hat Enterprise Linux command line assistant rhel-cla/rhel-knowledge-bridge-rhel10
    not affected: vulnerable code not in execute path
  • Red Hat Hardened Images nodejs26 26.9.0-0.1.hum1, python-cryptography 50.0.0-1.hum1, rust-rpm-sequoia 1.10.1.1-1.4.hum1
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-llm-d-inference-scheduler-rhel9, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, +65 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, +98 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-autorag-rhel9 1791903266, rhoai/odh-trainer-rhel9 1791952138, +112 more
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
last mo.

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io rustls-webpki
<0.103.13
>=0.104.0-alpha.1, <0.104.0-alpha.7
>=0.0.0-0, <0.103.13
0.103.13
0.104.0-alpha.7

Affected products

  • rustls webpki

Classification

Weakness
  • CWE-191 Integer Underflow (Wrap or Wraparound)
  • CWE-125 Out-of-bounds Read

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.