https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T17:02:50.052830+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-cx34477 Withdrawn: CLEANSTART-2026-CX34477 — Security fixes in ztunnel-fips 1.27.9-r0 2026-10-08T17:02:50.083911+00:00

Withdrawn by the publisher.

Affected: CleanStart: ztunnel-fips

Package ztunnel-fips version 1.27.9-r0 fixes 4 vulnerabilities: ghsa-pwjx-qhcg-rvj4, ghsa-965h-392x-2mh5, ghsa-xgp8-3hg3-c2mh, ghsa-82j2-j2ch-gfr8

 https://cve.radiocsirt.org/vuln/rustsec-2026-0104 RUSTSEC-2026-0104 — Reachable panic in certificate revocation list parsing 2026-10-08T17:02:50.083970+00:00

Affected: crates.io: rustls-webpki

A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`] or [`OwnedCertRevocationList::from_der`]. This was the result of mishandling a syntactically valid empty `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to [@tynus3](https://github.com/tynus3) for the report.