Security vulnerability in dependency rustls-webpki

[RolandColored]

Currently two different versions of rustls are pulled in, the older version is vulnerable now: GHSA-82j2-j2ch-gfr8

The dependency is listed here for example, although the newer version is already there as well:

smithy-rs/aws/sdk/Cargo.lock

Line 1322 in 259d444

"rustls 0.21.12",

Inverted dependency tree:

➜  cargo tree --invert rustls-webpki@0.101.7
rustls-webpki v0.101.7
└── rustls v0.21.12
    ├── aws-smithy-http-client v1.1.12
    │   └── aws-smithy-runtime v1.11.1
    │       ├── aws-config v1.8.16
    │       │   └── private-crate
    │       ├── aws-runtime v1.7.3
    │       │   ├── aws-config v1.8.16 (*)
    │       │   ├── aws-sdk-rds v1.132.0
    │       │   │   └── private-crate
    │       │   ├── aws-sdk-secretsmanager v1.104.0
    │       │   │   └── private-crate
    │       │   ├── aws-sdk-sso v1.98.0
    │       │   │   └── aws-config v1.8.16 (*)
    │       │   ├── aws-sdk-ssooidc v1.100.0
    │       │   │   └── aws-config v1.8.16 (*)
    │       │   └── aws-sdk-sts v1.103.0
    │       │       └── aws-config v1.8.16 (*)
    │       ├── aws-sdk-rds v1.132.0 (*)
    │       ├── aws-sdk-secretsmanager v1.104.0 (*)
    │       ├── aws-sdk-sso v1.98.0 (*)
    │       ├── aws-sdk-ssooidc v1.100.0 (*)
    │       └── aws-sdk-sts v1.103.0 (*)
    ├── hyper-rustls v0.24.2
    │   └── aws-smithy-http-client v1.1.12 (*)
    └── tokio-rustls v0.24.1
        └── hyper-rustls v0.24.2 (*)

[vcjana]

Thanks for raising this. The practical impact is low for most SDK users GHSA-82j2-j2ch-gfr8 requires CRL revocation checking to be explicitly enabled via RevocationOptions, which is off by default in the SDK's TLS configuration.

The underlying issue is the legacy hyper-rustls 0.24 / rustls 0.21 dependency chain that still ships alongside the newer hyper 1.x / rustls 0.23 stack for backward compatibility. Users on BehaviorVersion::v2026_01_12() or later use the new stack at runtime.

If you want to avoid pulling in the legacy deps, you can set default-features = false on the SDK crates and only enable what you need:

aws-sdk-s3 = { version = "1", default-features = false, features = ["behavior-version-latest", "rt-tokio", "default-https-client"] }

We're actively working on removing the legacy stack from default features.