CVE-2026-41676
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In rust-openssl versions 0.9.27 through 0.10.77, a heap/stack overflow vulnerability exists in Deriver::derive and PkeyCtxRef::derive functions. On OpenSSL 1.1.x, EVP_PKEY_derive ignores the provided buffer size and writes the full shared secret, causing overflow even from safe Rust code.
Risk Assessment
An attacker could exploit this vulnerability to cause application crashes or potentially achieve remote code execution via memory overflow, posing a serious threat to system integrity and availability.
Recommendation
Immediately update rust-openssl to version 0.10.78 or later. If using OpenSSL 1.1.x, consider migrating to OpenSSL 3.x which is not affected by this issue.
Other vulnerabilities in rust-openssl
See all- CVE-2026-42327High
In the rust-openssl library, versions from 0.9.7 to before 0.10.79, there is a vulnerability related to improper processing of OCSP responder URLs from a certificate's AIA extension. The use of invalid bytes in the OCSP accessLocation can lead to a violation of the UTF-8 invariant, resulting in undefined behavior.
- CVE-2026-45784High
Vulnerability in rust-openssl from 0.10.50 to 0.10.80. The `CipherCtxRef::cipher_update_inplace` function incorrectly sizes output buffers for AES key-wrap-with-padding ciphers (`EVP_aes_{128,192,256}_wrap_pad`), causing up to 7 bytes of out-of-bounds write and heap corruption when input length is not a multiple of 8.
- CVE-2026-41898Medium
A vulnerability in the rust-openssl library (versions 0.9.24 through 0.10.78) causes the PSK and cookie callbacks to not validate the user closure's return value against the buffer size. This can lead to buffer overflows and other unintended consequences.
- CVE-2026-41681High
In the rust-openssl library versions 0.10.39 through 0.10.77, there is a buffer overflow vulnerability in the EVP_DigestFinal() function. This function always writes EVP_MD_CTX_size(ctx) bytes to the output buffer, which when the buffer is smaller leads to a write past its end and potential stack corruption. The issue is reachable from safe Rust code.
- CVE-2026-41678High
In the rust-openssl library before version 0.10.78, the aes::unwrap_key() function contains an incorrect assertion: it checks out.len() + 8 <= in_.len() instead of the correct out.len() >= in_.len() - 8. This leads to an out-of-bounds write when a smaller output buffer is provided.
Original NVD description (English source)
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.