CRLs not considered authoritative by Distribution Point due to faulty matching logic

F-RUSTLS-WEBPKI-001

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Read the evidence · View in research browse

Recorded evidence

4.4medium

CVE-2026-93602CVErustls/webpki

CRLs not considered authoritative by Distribution Point due to faulty matching logic

Fixed in: 0.104.0-alpha.5, 0.103.10

patched

details

Finding IDs: F-RUSTLS-WEBPKI-001
CVE: CVE-2026-93602
GHSA: GHSA-pwjx-qhcg-rvj4
Status: patched
Fixed in: 0.104.0-alpha.5, 0.103.10
Note: CVE-2026-93602: VulnCheck CNA record verified PUBLISHED on 2026-09-23; CVE publication 2026-09-18. Assigned by VulnCheck; the repository GHSA snapshot still has no CVE identifier.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CVE registry state: PUBLISHED
CVE state checked: 23 Sep 2026
Upstream title: CRLs not considered authoritative by Distribution Point due to faulty matching logic
Upstream CWE: CWE-299
Upstream publication: 20 Mar 2026
Upstream updated: 23 Mar 2026
Metadata fetched: 23 Sep 2026
Upstream @1seal credit: @1seal: reporter (accepted)
CVE mapping note: Recorded CVE and upstream metadata differ; upstream CVE: not assigned in this snapshot. The recorded mapping has not been changed.

F-RUSTLS-WEBPKI-001: Verification failures. CRL authority matching is incomplete. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-RUSTLS-WEBPKI-001

Security area (1seal assessment): Identity. CRL authority matching is incomplete. Reviewed 24 Sep 2026.

—score not recorded

rustls/webpki #469Credited fixrustls/webpki

Rewrite constraint matching to avoid permissive catch-all branch

merged

details

Finding IDs: F-RUSTLS-WEBPKI-001
Status: merged
Recorded credit: PR description says it addresses an issue privately reported by @1seal.
Note: merged into main on 2026-04-13; merge commit 9e1f4822932b. GHSA-pwjx-qhcg-rvj4 already published for the same finding.

F-RUSTLS-WEBPKI-001: Verification failures. CRL authority matching is incomplete. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-RUSTLS-WEBPKI-001

Security area (1seal assessment): Identity. CRL authority matching is incomplete. Reviewed 24 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.