CVE-2026-93602

Name	CVE-2026-93602
Description	rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1133085

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-rustls-webpki (PTS)	trixie	0.102.8-5	vulnerable
	forky, sid	0.103.15+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-rustls-webpki	source	(unstable)	0.103.10+ds-1			1133085

Notes

[trixie] - rust-rustls-webpki <no-dsa> (Minor issue)
https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4
https://rustsec.org/advisories/RUSTSEC-2026-0049.html