CVE-2026-93602

A flaw was found in rustls-webpki. The component contains faulty Certificate Revocation List (CRL) authority-matching logic, which incorrectly compares only the first distribution point against each CRL's issuing distribution point, ignoring others. This vulnerability allows an attacker with a compromised trusted issuing authority to present revoked certificates that bypass revocation checks, potentially leading to the acceptance of invalid certificates.

This vulnerability is rated as Moderate impact because successful exploitation requires elevated privileges or a compromised trusted certificate authority to craft certificates and revocation lists, presenting a high attack complexity. Additionally, rustls-webpki defaults to a strict deny policy that rejects unconfirmed certificates rather than silently trusting them. Acceptance of invalid credentials is only possible in non-standard configurations where consumers explicitly enable permissive revocation status policies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.