CVE-2026-93602 rustls-webpki before 0.103.10 CRL Revocation Check Bypass
Attackers with a compromised CA can bypass CRL revocation checks in rustls-webpki, allowing revoked certificates to be accepted.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93602?
CVE-2026-93602 is a medium-severity vulnerability in rustls webpki, published on 18 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.
Weakness: CWE-299
Which versions are affected by CVE-2026-93602?
5 open source packages ship an affected version, including rustls-webpki.
| Package | Affected | Fixed in |
|---|---|---|
rustls-webpki crates.io | From 0.102.0-alpha.0 | 0.103.10 |
rustls-webpki crates.io | From 0.102.0-alpha.0 | 0.103.10 |
rustls-webpki crates.io | From 0.102.0-alpha.0 | 0.103.10 |
rustls-webpki crates.io | From 0.104.0-alpha.1 | 0.104.0-alpha.5 |
rustls-webpki crates.io | From 0.104.0-alpha.1 | 0.104.0-alpha.5 |
How do I fix CVE-2026-93602?
Upgrade rustls-webpki to a fixed version for your release line: 0.103.10 or 0.104.0-alpha.5.
Is CVE-2026-93602 being exploited?
There is no known exploitation of CVE-2026-93602 in the wild and no public exploit code.
Sources
Also known as AZL-103463, AZL-103503, AZL-103511, AZL-103524, CLEANSTART-2026-XA32813, DEBIAN-CVE-2026-93602 and 26 more.