CyberSecBulletin

Rustls vulnerabilities

We track 2 vulnerabilities in Rustls products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Rustls vulnerabilities

  • 7.5 High severity

    webpki: Integer Underflow (Wrap or Wraparound)

    CVE-2026-93599Rustls

    rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no

  • 7.5 High severity

    rustls: Loop with Unreachable Exit Condition

    CVE-2024-32650Rustls

    Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, th