Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A reachable panic in `rustls-webpki` <= 0.103.12 during Certificate Revocation List (CRL) parsing is pulled into nvulnlookup transitively through `rustls` 0.23.38, `quinn-proto` 0.11.14 / `quinn` 0.11.9 (HTTP/3), `reqwest` 0.12.28, `hyper-rustls` 0.27.9, and `rustls-platform-verifier` 0.6.2. Attacker-supplied CRL bytes — reachable in nvulnlookup via outbound HTTPS connections that present a CRL-bearing peer certificate and via any inbound HTTPS handshake where a client presents a malformed CRL — would trigger a deterministic panic inside `rustls-webpki::crl`, resulting in a denial-of-service condition for the panicking task. Fixed in rustls-webpki 0.103.13 by reworking the CRL parser to return an error rather than panic. nvulnlookup v0.1.32 ships the patched version via `cargo update -p rustls-webpki`; no first-party code change was required.",
"title": "Summary"
},
{
"category": "description",
"text": "The RustSec advisory database published RUSTSEC-2026-0104 on 2026-04-22 documenting a panic path in rustls-webpki's CRL parser. A malformed CRL (either one that is linked from an upstream server we connect to for vulnerability feed ingestion, or one that a TLS client includes in its handshake when probing our listener) can push the parser through an unchecked slice index and trigger a `panic!` inside `rustls-webpki::crl::parse_crl`. In nvulnlookup, the panic is isolated to the tokio task handling the offending connection — it does NOT take down the whole server, because rustls operates inside a per-connection tokio task that tokio reaps on panic. A persistent attacker can, however, repeatedly open new connections and force CRL parsing on each, exhausting CPU and the task scheduler.\n\nImpact classification: availability (CWE-248 Uncaught Exception / CWE-755 Improper Handling of Exceptional Conditions). No confidentiality or integrity impact — the parser panics before any certificate decision is taken, so no invalid certificate is ever accepted.\n\nReachability in nvulnlookup:\n- INBOUND: vl-web's HTTPS listener on 8180 / HTTP/3 listener on 8181 presents our own cert; client-side CRLs are NOT consumed in the default configuration, so the inbound attack surface is theoretical (no CRL validation is performed on client certs — mTLS is not enabled in v0.1.32).\n- OUTBOUND: vl-feeders performs outbound HTTPS to ~40 vulnerability sources (NVD, CISA KEV, OSV, GHSA, CERT-FR, …). Any of those endpoints could serve a malformed CRL as part of its certificate chain, triggering the panic in the task handling that feeder. The scheduler would re-spawn the task on the next cycle, so the effect is transient but observable as periodic feeder failures.\n\nMitigation therefore landed via a direct Cargo.lock bump (`cargo update -p rustls-webpki` → 0.103.13), with no source-code changes required in any vl-* crate. `cargo audit --deny warnings --deny unsound --deny unmaintained --deny yanked` and `cargo deny check` both report zero findings post-bump against 404 dependencies.",
"title": "Vulnerability Description"
},
{
"category": "general",
"text": "nvulnlookup vl-web depends on rustls 0.23.38 (directly for the HTTPS listener and indirectly through reqwest, hyper-rustls, quinn) and on rustls-platform-verifier 0.6.2 which itself pulls rustls-webpki. The transitive dependency graph places rustls-webpki on the hot path for every TLS handshake, including the outbound handshakes that the 40-odd feed-fetcher tasks perform every update cycle. Keeping rustls-webpki on the latest patched release is therefore required to preserve availability under hostile or malformed upstream TLS behaviour.",
"title": "Context"
},
{
"category": "other",
"text": "Disposition: fixed in nvulnlookup 0.1.32. Downstream operators running any prior v0.1.x release are advised to pull v0.1.32 or run `cargo update -p rustls-webpki` in their local checkout and rebuild.",
"title": "Disposition"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/019/ndaal-sa-2026-019.json"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0104 — reachable panic in rustls-webpki CRL parsing",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0104"
},
{
"category": "external",
"summary": "rustls-webpki 0.103.13 release (fix)",
"url": "https://github.com/rustls/webpki/releases/tag/v0.103.13"
},
{
"category": "external",
"summary": "rustls-webpki CHANGELOG — 0.103.13 section",
"url": "https://github.com/rustls/webpki/blob/main/CHANGELOG.md"
},
{
"category": "external",
"summary": "nvulnlookup Cargo.lock bump landing the patched rustls-webpki",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/Cargo.lock"
}
],
"title": "ndaal Security Advisory: RUSTSEC-2026-0104 — rustls-webpki CRL parser panic — fixed in nvulnlookup 0.1.32",
"tracking": {
"current_release_date": "2026-04-22T21:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-019",
"initial_release_date": "2026-04-22T21:00:00.000Z",
"revision_history": [
{
"date": "2026-04-22T21:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: document the reachable panic in rustls-webpki <= 0.103.12 CRL parsing, its transitive pull path through rustls / quinn / reqwest / hyper-rustls / rustls-platform-verifier, and the Cargo.lock bump to 0.103.13 that ships in nvulnlookup 0.1.32."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "nvulnlookup",
"branches": [
{
"category": "product_version_range",
"name": "vers:cargo/<0.1.32",
"product": {
"name": "nvulnlookup vl-web / vl-cli / vl-core / vl-feeders / vl-models <= 0.1.31 — ships rustls-webpki 0.103.12 (affected)",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.1.32",
"product": {
"name": "nvulnlookup 0.1.32 — ships rustls-webpki 0.103.13 (patched)",
"product_id": "CSAFPID-0002"
}
}
]
}
]
},
{
"category": "vendor",
"name": "rustls project",
"branches": [
{
"category": "product_name",
"name": "rustls-webpki",
"branches": [
{
"category": "product_version_range",
"name": "vers:cargo/<=0.103.12",
"product": {
"name": "rustls-webpki <=0.103.12 — affected upstream",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "0.103.13",
"product": {
"name": "rustls-webpki 0.103.13 — patched upstream",
"product_id": "CSAFPID-0004"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"ids": [
{
"system_name": "RustSec",
"text": "RUSTSEC-2026-0104"
},
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-019#rustls-webpki-crl-panic"
}
],
"notes": [
{
"category": "description",
"text": "A malformed Certificate Revocation List presented to rustls-webpki <= 0.103.12 triggers a deterministic panic inside `rustls-webpki::crl::parse_crl` before any revocation decision is reached. nvulnlookup reaches this code path via two channels: (1) outbound feed-fetcher HTTPS connections through reqwest + hyper-rustls + quinn-proto to ~40 vulnerability sources; (2) inbound HTTPS / HTTP-3 handshakes on ports 8180 / 8181 via rustls 0.23.38 + quinn 0.11.9. The panic is confined to the tokio task handling the individual connection — tokio reaps the task and the server process survives — but a persistent attacker can re-open connections to force repeated parser panics and drive CPU exhaustion.",
"title": "Technical Description"
},
{
"category": "details",
"text": "The fix in rustls-webpki 0.103.13 replaces the panicking slice index with a `Result::Err` return, so a malformed CRL now surfaces as a normal TLS `InvalidExtension` error rather than a process-level panic. No API or ABI change — the bump is a pure Cargo.lock update.",
"title": "Upstream Fix Detail"
},
{
"category": "other",
"text": "CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Availability-only, network-reachable, no privileges required, no user interaction, scope unchanged. Low availability impact because the panic is contained to a single task; no confidentiality or integrity impact because the panic fires before certificate validation yields a verdict.",
"title": "CVSS Rationale"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003"
],
"fixed": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade nvulnlookup to 0.1.32 or later. For downstream maintainers who track an older v0.1.x tag, the fix is a one-line `cargo update -p rustls-webpki` in the project root followed by `cargo build --release` — no source-file change is required. Re-run `cargo audit --deny warnings --deny unsound --deny unmaintained --deny yanked` to confirm the advisory is cleared.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/CHANGELOG.md",
"date": "2026-04-22T21:00:00.000Z"
},
{
"category": "mitigation",
"details": "Where pulling v0.1.32 is not immediately possible, operators can restrict inbound exposure of ports 8180 / 8181 to authenticated peers only (reverse proxy with mTLS / oauth2-proxy). The outbound feeder attack vector cannot be mitigated without the rustls-webpki bump, because any upstream vulnerability-feed endpoint serving a malformed CRL will trigger the panic.",
"product_ids": [
"CSAFPID-0001"
],
"date": "2026-04-22T21:00:00.000Z"
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003"
]
}
],
"title": "Reachable panic in rustls-webpki CRL parsing (RUSTSEC-2026-0104)"
}
]
}