rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.
CVE-2026-93599
Score 7.5 from GitHub Security Advisory (severity: HIGH) published 2026-09-18. a secondary CVSS source baseline 7.5; sources differ by 0.0.
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 7.5
- EG Score
- 7.5(high)
- EG Risk
- 38(Track)EG Risk 38/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity75% × 45%Exploitation0% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 28%
- KEV
- Not listed
Published
September 18, 2026
Last Modified
September 18, 2026
Advisory Details (2)
Auto-updated Sep 18, 2026rustls-webpki before 0.103.13 Panic via empty BIT STRING | Advisories | VulnCheck
https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-stringPanic in `BorrowedCertRevocationList::from_der` via empty `BIT STRING` in `IssuingDistributionPoint` · Advisory · rustls/webpki · GitHub
https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8Vendor Advisories for CVE-2026-93599(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 7× in last 7d / 7× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-19 15:56 UTCEG score recompute
- 2026-09-19 15:55 UTCGHSA enrichment
- 2026-09-19 03:40 UTCEG score recompute
- 2026-09-19 03:40 UTCGHSA enrichment
- 2026-09-18 14:21 UTCEG score recompute
- 2026-09-18 13:29 UTCEG score recompute
- 2026-09-18 13:29 UTCMITRE cvelistV5first tracked
Related CVEs(same CWE)
Same CWE
10 shownCWE-191
Frequently asked(5)
What is CVE-2026-93599?
When was CVE-2026-93599 disclosed?
Is CVE-2026-93599 actively exploited?
What is the CVSS score of CVE-2026-93599?
How do I remediate CVE-2026-93599?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-93599
Is Your Infrastructure Affected by CVE-2026-93599?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.