AIKIDO-2026-370640

TL;DR

The bcder crate decodes BER, CER, and DER ASN.1 data from untrusted inputs such as certificates and RPKI objects. Before 0.7.7, malformed UTF-8 in Utf8String parsing could construct invalid Rust characters via unsafe decoding, and gaps in BitString, Unsigned, and restricted-string handling allowed incorrect bit reads, charset bypass, panic on valid zero integers, and acceptance of non-conformant DER/CER bit strings. An attacker supplying crafted ASN.1 could trigger undefined behavior, integrity errors, or denial of service. Version 0.7.7 adds strict UTF-8 and charset validation, corrects BitString bounds and unused-bit checks, and returns canonical zero encodings without panicking.