CVE-2026-93599

A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List (CRL) that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of service (DoS) in applications that explicitly enable CRL revocation checking.

This vulnerability is rated as Important because an unauthenticated remote attacker can cause an immediate denial of service by triggering an unhandled panic in network-facing services. Exploitation requires the consuming software to explicitly enable Certificate Revocation List (CRL) validation, a capability that is disabled by default in standard rustls configurations. Applications and services that actively ingest revocation lists from untrusted endpoints face service termination, whereas environments utilizing default certificate verification workflows remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.