CVE-2026-93602

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93602
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93602.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93602
Aliases
Downstream
Published
2026-09-18T13:20:12Z
Modified
2026-09-19T03:55:49Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
rustls-webpki before 0.103.10 CRL Revocation Check Bypass
Details

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-299"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93602.json"
}
References

Affected packages

Git / github.com/rustls/webpki

Affected ranges

Type
GIT
Repo
https://github.com/rustls/webpki
Events
Introduced
e5c8c6d9e72396ac65d649a8a90f2fbb0d7a4e20
Fixed
348ce01c01cf8ce21199090c98853992c9c047a8
Introduced
5a23b7e1c7b6e898d6bb437730a029b2695aa3eb
Fixed
a531696b768d8a46f51fa36726e2f437292687de
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.102.0-alpha.0"
        },
        {
            "fixed": "0.103.10"
        },
        {
            "introduced": "0.104.0-alpha.1"
        },
        {
            "fixed": "0.104.0-alpha.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v/0.*
v/0.102.0
v/0.102.0-alpha.0
v/0.102.0-alpha.2
v/0.102.0-alpha.4
v/0.102.0-alpha.6
v/0.102.0-alpha.8
v/0.102.1
v/0.102.2
v/0.102.3
v/0.102.4
v/0.102.5
v/0.102.6
v/0.102.7
v/0.102.8
v/0.103.0
v/0.103.1
v/0.103.2
v/0.103.3
v/0.103.4
v/0.103.5
v/0.103.6
v/0.103.7
v/0.103.8
v/0.103.9
v/0.104.0-alpha.1
v/0.104.0-alpha.2
v/0.104.0-alpha.3
v/0.104.0-alpha.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93602.json"