GitHub Advisoryadvisory · crates.io

GHSA-xmgf-hq76-4vx2 rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

LOW Published 2026-04-22 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-41677
Ecosystem
crates.io
Packages
openssl
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-125, CWE-1284
Reviewed
2026-04-22

Affected packages

• crates.io openssl: >= 0.9.0, < 0.10.78 → fixed in 0.10.78

Description

The `*_from_pem_callback` APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.

Related

Alias · CVE (1)

  • CVE-2026-41677 rust-openssl provides OpenSSL bindings for the Rust programming language. vulnerability

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input weakness

References