GitHub Advisoryadvisory · crates.io

GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

HIGH Published 2026-04-22 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-41681
Ecosystem
crates.io
Packages
openssl
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-121
Reviewed
2026-04-22

Affected packages

• crates.io openssl: >= 0.10.39, < 0.10.78 → fixed in 0.10.78

Description

`EVP_DigestFinal()` always writes `EVP_MD_CTX_size(ctx)` to the `out` buffer. If `out` is smaller than that, `MdCtxRef::digest_final()` writes past its end, usually corrupting the stack. This is reachable from safe Rust.

Related

Alias · CVE (1)

  • CVE-2026-41681 rust-openssl provides OpenSSL bindings for the Rust programming language. vulnerability

Weakness · CWE (1)

  • CWE-121 Stack-based Buffer Overflow weakness

References