GitHub Advisoryadvisory · crates.io
GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
HIGH
Official page ↗
- Aliases
- CVE-2026-42327
- Ecosystem
- crates.io
- Packages
- openssl
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-20
- Reviewed
- 2026-05-05
Affected packages
• crates.io openssl: >= 0.9.7, < 0.10.79 → fixed in 0.10.79
Description
`X509Ref::ocsp_responders` returns OCSP responder URLs from a certificate's AIA extension as `OpensslString`, whose `Deref` wraps the raw bytes with `str::from_utf8_unchecked`. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a `&str` that violates the UTF-8 invariant — resulting in undefined behavior.
Related
Alias · CVE (1)
- CVE-2026-42327 rust-openssl provides OpenSSL bindings for the Rust programming language. vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness