{
  "cveId": "CVE-2026-93602",
  "url": "https://patchblox.com/security/cve/CVE-2026-93602",
  "summary": "CVE-2026-93602 is fixed in 7 products on 1 platform, first by DEBIAN-CVE-2026-93602, released September 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rustls-webpki before 0.103.10 CRL Revocation Check Bypass",
  "description": "rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL\u0027s IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can present revoked certificates that pass revocation checks under UnknownStatusPolicy::Allow, or cause incorrect errors under the default deny policy.",
  "published": "2026-09-18T14:19:11Z",
  "severity": "Moderate",
  "cvss": 4.4,
  "cwe": "Improper Check for Certificate Revocation",
  "epss": 0.002,
  "epssPercentile": 0.09986,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93602",
  "fixes": [
    {
      "platform": "linux",
      "product": "aws-nitro-enclaves-cli",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.5.2~git0.1c496ed-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22175-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22175-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "aws-nitro-enclaves-cli",
      "release": "sles 15.6",
      "fixedVersion": "1.5.2~git0.1c496ed-150600.10.18.1",
      "fix": "SUSE-SU-2026:5066-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5066-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "aws-nitro-enclaves-cli",
      "release": "sles 15.7",
      "fixedVersion": "1.5.2~git0.1c496ed-150600.10.18.1",
      "fix": "SUSE-SU-2026:5066-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5066-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "aws-nitro-enclaves-cli",
      "release": "sles 16.0",
      "fixedVersion": "1.5.2~git0.1c496ed-160000.1.1",
      "fix": "SUSE-SU-2026:24467-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24467-1",
      "released": "2026-11-07T00:45:20Z"
    },
    {
      "platform": "linux",
      "product": "rust-rustls-webpki",
      "release": "Debian 14",
      "fixedVersion": "0.103.10\u002Bds-1",
      "fix": "DEBIAN-CVE-2026-93602",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93602",
      "released": "2026-09-19T18:30:58Z"
    },
    {
      "platform": "linux",
      "product": "rustup",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.29.1~0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22016-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22016-1",
      "released": "2026-10-02T19:31:21Z"
    },
    {
      "platform": "linux",
      "product": "rustup",
      "release": "sles 16.0",
      "fixedVersion": "1.29.1~0-160000.1.1",
      "fix": "SUSE-SU-2026:24014-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24014-1",
      "released": "2026-10-02T19:21:30Z"
    },
    {
      "platform": "linux",
      "product": "sccache",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.18.0~2-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21982-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21982-1",
      "released": "2026-09-30T17:58:26Z"
    },
    {
      "platform": "linux",
      "product": "sccache",
      "release": "sles 16.0",
      "fixedVersion": "0.18.0~2-160000.1.1",
      "fix": "SUSE-SU-2026:23983-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23983-1",
      "released": "2026-09-30T17:49:13Z"
    },
    {
      "platform": "linux",
      "product": "sequoia-sq",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.5.0-bp160.1.1",
      "fix": "OPENSUSE-RU-2026:22132-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-ru-2026-22132-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "shadowsocks-libev",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.3.6-bp160.3.1",
      "fix": "OPENSUSE-SU-2026:22189-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22189-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "shadowsocks-rust",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.25.0-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22189-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22189-1",
      "released": "2026-11-07T00:47:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}