GHSA-pwjx-qhcg-rvj4

Suggest an improvement
Source
https://github.com/advisories/GHSA-pwjx-qhcg-rvj4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pwjx-qhcg-rvj4/GHSA-pwjx-qhcg-rvj4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pwjx-qhcg-rvj4
Aliases
Downstream
CGA (148)
MINI (22)
Published
2026-03-20T21:51:17Z
Modified
2026-09-19T03:55:49Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic
Details

If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correct provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

Database specific 
{
    "cwe_ids":  [
        "CWE-299"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-20T21:51:17Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

crates.io / rustls-webpki

Package

Name
rustls-webpki
View open source insights on deps.dev
Purl
pkg:cargo/rustls-webpki

Affected ranges

Type
SEMVER
Events
Introduced
0.102.0-alpha.0
Fixed
0.103.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pwjx-qhcg-rvj4/GHSA-pwjx-qhcg-rvj4.json"

crates.io / rustls-webpki

Package

Name
rustls-webpki
View open source insights on deps.dev
Purl
pkg:cargo/rustls-webpki

Affected ranges

Type
SEMVER
Events
Introduced
0.104.0-alpha.1
Fixed
0.104.0-alpha.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pwjx-qhcg-rvj4/GHSA-pwjx-qhcg-rvj4.json"