CVE-2026-93599: 
Samba vulnerability analysis and mitigation

CVE-2026-93599 is a denial-of-service vulnerability in the rustls-webpki Rust library caused by a reachable panic in the bit_string_flags() function in src/der.rs. It affects rustls-webpki versions through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7. The vulnerability was discovered via differential fuzzing against a formally-verified Rust oracle and published on September 18, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, rustls Advisory).

The root cause is an integer underflow (CWE-191) combined with an out-of-bounds read (CWE-125) in bit_string_flags() within src/der.rs. The input validation guard checks if padding_bits > 7 || (raw_bits.is_empty() && padding_bits != 0) but fails to handle the case where padding_bits == 0 and raw_bits is empty simultaneously. When a CRL's issuingDistributionPoint extension contains an onlySomeReasons BIT STRING with content exactly [0x00] (one byte: zero padding bits, zero data bytes), raw_bits.len() - 1 underflows to usize::MAX, and the subsequent index operation raw_bits[usize::MAX] panics — with "subtract with overflow" in debug builds and "index out of bounds" in release builds. The vulnerability is reachable via the public API BorrowedCertRevocationList::from_der() only when an application explicitly passes RevocationOptions to verify_for_usage(); the default rustls configuration is unaffected (rustls Advisory, GitHub Advisory).

Successful exploitation causes the affected Rust process to panic and terminate, resulting in a denial of service. There is no impact on confidentiality or integrity — no data is exposed and no unauthorized modifications occur. The attack is purely a crash-based DoS, and the scope is limited to applications that have explicitly enabled CRL revocation checking; services using the default rustls configuration are not at risk (rustls Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (a standalone Rust program that triggers the panic via a 103-byte crafted CRL) is publicly available in the rustls/webpki GitHub security advisory (rustls Advisory). No in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.35–0.49%, reflecting low but non-negligible exploitation probability. Exploitation is automatable and requires no authentication or user interaction, but is gated by the application-level precondition of CRL revocation checking being explicitly enabled (GitHub Advisory).

1. Identify target applications: Determine whether the target application uses rustls-webpki (versions ≤ 0.103.12 or 0.104.0-alpha.1 through 0.104.0-alpha.6) with CRL revocation checking explicitly enabled via RevocationOptions passed to verify_for_usage().
2. Craft the malformed CRL: Construct a DER-encoded CRL containing an issuingDistributionPoint extension (OID 2.5.29.28) with an onlySomeReasons BIT STRING field set to exactly [0x00] (one byte: zero padding bits, zero data bytes). The complete 103-byte PoC payload is: 0x30, 0x65, 0x30, 0x50, 0x02, 0x01, 0x01, ... ending with 0x83, 0x01, 0x00 as the trigger (rustls Advisory).
3. Deliver the crafted CRL to the target via one of these paths:
   • mTLS attack: Obtain a certificate from a CA that allows custom CRL Distribution Point (CDP) URLs, set the CDP to an attacker-controlled server, serve the crafted CRL, and initiate a connection to the target mTLS server.
   • MITM attack: Intercept HTTP CRL distribution point requests on a local network (via ARP or DNS poisoning) and substitute the crafted CRL for the legitimate one.
4. Trigger parsing: The target application calls BorrowedCertRevocationList::from_der() on the attacker-supplied CRL bytes during certificate verification.
5. Achieve DoS: The bit_string_flags() function processes the malformed BIT STRING, the underflow occurs, and the process panics and terminates with an index-out-of-bounds error (rustls Advisory).

• Logs: Application crash logs or stderr output containing thread 'main' panicked at src/der.rs with message index out of bounds: the len is 0 but the index is 18446744073709551615 (release build) or attempt to subtract with overflow (debug build).
• Network: Unexpected HTTP responses from CRL distribution point URLs containing a 103-byte DER-encoded payload; unusual CRL fetch requests to unfamiliar or attacker-controlled domains during TLS handshakes.
• Process: Sudden, unexplained termination of Rust services using rustls-webpki during TLS certificate verification, particularly in mTLS or client-certificate scenarios where CRL checking is enabled.
• File System: Presence of crafted CRL files (103 bytes, DER-encoded) in temporary directories or CRL caches used by the application (rustls Advisory).

Update rustls-webpki to version 0.103.13 or 0.104.0-alpha.7 or later, which fix the incomplete input guard in bit_string_flags() (rustls Advisory, GitHub Advisory). Applications using the default rustls configuration without explicit RevocationOptions are not affected and do not require immediate action. As a temporary workaround for applications that cannot immediately upgrade, restrict CRL sources to trusted, internally controlled distribution points to reduce attacker influence over parsed CRL bytes.

Red Hat tracked the vulnerability as high severity in their Bugzilla system and engaged their product security team across a broad set of affected packages (Red Hat Bugzilla). Microsoft also acknowledged the vulnerability through their Security Response Center (Microsoft). OpenSUSE issued security announcements addressing the issue in their package ecosystem. The advisory notes that the vulnerability was discovered using AI-assisted differential fuzzing against a formally-verified Rust oracle, which drew some community interest as a novel discovery methodology (rustls Advisory).