From fe99e0d1f3770c5ac12e0a5c57f0ebb462996170 Mon Sep 17 00:00:00 2001 From: Elias Rohrer Date: Wed, 22 Apr 2026 12:47:34 +0200 Subject: [PATCH] Bump `rustls-webpki` to patched version in lock files RUSTSEC-2026-0104 reports a reachable DoS panic in `rustls-webpki` versions prior to `0.103.13` when parsing a CRL whose `IssuingDistributionPoint.onlySomeReasons` extension contains a syntactically valid empty `BIT STRING`. Bumping the pinned version in both checked-in lock files to `0.103.13` addresses the advisory. Co-Authored-By: HAL 9000 Signed-off-by: Elias Rohrer --- Cargo-minimal.lock | 4 ++-- Cargo-recent.lock | 4 ++-- bitreq/Cargo.toml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock index e40aa10c1..da13839e4 100644 --- a/Cargo-minimal.lock +++ b/Cargo-minimal.lock @@ -947,9 +947,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.12" +version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06" +checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ "ring", "rustls-pki-types", diff --git a/Cargo-recent.lock b/Cargo-recent.lock index e40aa10c1..da13839e4 100644 --- a/Cargo-recent.lock +++ b/Cargo-recent.lock @@ -947,9 +947,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.12" +version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06" +checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ "ring", "rustls-pki-types", diff --git a/bitreq/Cargo.toml b/bitreq/Cargo.toml index c70cb84c1..108b27826 100644 --- a/bitreq/Cargo.toml +++ b/bitreq/Cargo.toml @@ -24,7 +24,7 @@ base64 = { version = "0.22", default-features = false, features = ["alloc"], opt rustls = { version = "0.23.38", default-features = false, features = ["ring", "std", "tls12"], optional = true } rustls-native-certs = { version = "0.8.3", default-features = false, optional = true } webpki-roots = { version = "1.0.7", default-features = false, optional = true } -rustls-webpki = { version = "0.103.12", default-features = false, optional = true } +rustls-webpki = { version = "0.103.13", default-features = false, optional = true } # For native-tls-based TLS: native-tls = { version = "0.2", default-features = false, optional = true }