diff --git a/lib/rules/rules.ex b/lib/rules/rules.ex
index 096992e1..cd42fcfb 100644
--- a/lib/rules/rules.ex
+++ b/lib/rules/rules.ex
@@ -246,6 +246,19 @@ defmodule Hypatia.Rules do
             findings
           end
 
+        # Detect vulnerable rustls-webpki versions (CRL BIT STRING DoS panic)
+        # GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, CVSS 7.5 HIGH; fixed in 0.103.13.
+        # Transitive/lockfile-only: Dependabot frequently will NOT auto-PR this --
+        # remediation needs a manual `cargo update -p rustls-webpki` (see estate
+        # baseline dev-notes/2026-06-16-estate-dependency-security-control-plane.md).
+        findings =
+          if Regex.match?(~r/name = "rustls-webpki"\s+version = "0\.(101\.\d+|102\.\d+|103\.([0-9]|1[0-2]))"/, content) do
+            [%{rule: "rustls-webpki-crl-panic-dos", severity: :high,
+               description: "Vulnerable rustls-webpki version detected in Cargo.lock -- update to >= 0.103.13 (GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, DoS via panic on malformed CRL BIT STRING)"} | findings]
+          else
+            findings
+          end
+
         findings
       else
         findings
diff --git a/lib/rules/security_errors.ex b/lib/rules/security_errors.ex
index 8a044e68..4d87f0a3 100644
--- a/lib/rules/security_errors.ex
+++ b/lib/rules/security_errors.ex
@@ -190,6 +190,7 @@ defmodule Hypatia.Rules.SecurityErrors do
     "glib-variantstriter-unsoundness" => "Update glib to v0.22.3, v0.20.7, v0.19.10 or v0.18.6",
     "protobuf-recursion-crash" => "Update protobuf to >= 3.7.2",
     "idna-punycode-mishandling" => "Update idna to >= 1.0.0",
+    "rustls-webpki-crl-panic-dos" => "Update rustls-webpki to >= 0.103.13 (cargo update -p rustls-webpki); transitive dep, Dependabot may not auto-PR",
     "jsonwebtoken-type-confusion" => "Update jsonwebtoken to >= 10.3.0",
     "npm-js-yaml-vulnerability" => "Update js-yaml to >= 3.14.2 or 4.1.1",
     "npm-serialize-javascript-vulnerability" => "Update serialize-javascript to >= 6.0.2 or 7.0.0",