{"record":{"id":"8e3933183fbf8313","repo":"grpc/grpc-go","slug":"trailing-data-after-akid-extension","errorCode":null,"errorMessage":"trailing data after AKID extension","messagePattern":"trailing data after AKID extension","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"security/advancedtls/crl.go","lineNumber":332,"sourceCode":"// parseCRLExtensions parses the extensions for a CRL\n// and checks that they're supported by the parser.\nfunc parseCRLExtensions(c *x509.RevocationList) (*CRL, error) {\n\tif c == nil {\n\t\treturn nil, errors.New(\"c is nil, expected any value\")\n\t}\n\tcertList := &CRL{certList: c}\n\n\tfor _, ext := range c.Extensions {\n\t\tswitch {\n\t\tcase oidDeltaCRLIndicator.Equal(ext.Id):\n\t\t\treturn nil, fmt.Errorf(\"delta CRLs unsupported\")\n\n\t\tcase oidAuthorityKeyIdentifier.Equal(ext.Id):\n\t\t\tvar a authKeyID\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &a); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after AKID extension\")\n\t\t\t}\n\t\t\tcertList.authorityKeyID = a.ID\n\n\t\tcase oidIssuingDistributionPoint.Equal(ext.Id):\n\t\t\tvar dp issuingDistributionPoint\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after IssuingDistributionPoint extension\")\n\t\t\t}\n\n\t\t\tif dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {\n\t\t\t\treturn nil, errors.New(\"CRL only contains some certificate types\")\n\t\t\t}\n\t\t\tif dp.IndirectCRL {\n\t\t\t\treturn nil, errors.New(\"indirect CRLs unsupported\")\n\t\t\t}\n\t\t\tif dp.OnlySomeReasons.BitLength != 0 {","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/security/advancedtls/crl.go#L314-L350","documentation":"Returned by parseCRLExtensions (security/advancedtls/crl.go:332) when ASN.1 unmarshalling the Authority Key Identifier extension leaves trailing bytes. Per DER/BER rules a well-formed extension must consume exactly its encoded length, so leftover bytes indicate a corrupt or non-conformant AKID extension. The check is at lines 327-334.","triggerScenarios":"A CRL whose AKID extension value is malformed, truncated, or contains extra trailing data beyond the single SEQUENCE; a hand-crafted or partially corrupted CRL file.","commonSituations":"A buggy CA emitting non-canonical AKID encoding; CRL tampering; a download/copy that truncated or concatenated bytes; an ASN.1 library producing non-minimal encoding.","solutions":["Re-fetch the CRL from the authoritative distribution point to rule out transfer corruption.","If you control the CA, regenerate the CRL with a standards-compliant AKID extension (single DER SEQUENCE, no trailing bytes).","Validate the CRL with openssl (openssl crl -inform DER -text) to confirm the extension parses.","If the CRL is genuinely malformed, exclude it from verification or obtain a corrected one."],"exampleFix":"# before: corrupt CRL at /etc/crls/ca.crl\nopenssl crl -inform DER -in /etc/crls/ca.crl -text -noout # parse error / trailing data\n\n# after: re-fetch a clean CRL\ncurl -sfo /etc/crls/ca.crl https://ca.example.com/ca.crl\nopenssl crl -inform DER -in /etc/crls/ca.crl -text -noout # OK","handlingStrategy":"validation","validationCode":"// validate the AKID extension decodes with no trailing bytes before use\nvar a authKeyID\nrest, err := asn1.Unmarshal(akidExt.Value, &a)\nif err != nil || len(rest) != 0 {\n    return fmt.Errorf(\"CRL has malformed AKID extension\")\n}","typeGuard":null,"tryCatchPattern":"_, err := crl.Verify(cert, opts)\nif err != nil && strings.Contains(err.Error(), \"trailing data after AKID\") {\n    // re-fetch CRL from authoritative source, then retry\n}","preventionTips":["Fetch CRLs from their authoritative distribution point.","Sanity-check CRL files with openssl crl before configuring them.","Detect and reject corrupted CRLs at fetch time."],"tags":["go","grpc","security","tls","crl","x509","asn1","pkix"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}