Skip to content
Threat Feed

Product

Openssl

4 briefs RSS
high advisory

rust-openssl Unchecked Callback Length Memory Leak

The rust-openssl crate versions 0.9.24 prior to 0.10.78 are vulnerable to memory leaks due to unchecked callback lengths in PSK/cookie trampolines, potentially leading to buffer overflows.

openssl rust memory leak buffer overflow
2r
high advisory

rust-openssl AES Key Wrap Out-of-Bounds Write Vulnerability

The rust-openssl package is vulnerable to an out-of-bounds write due to an incorrect bounds assertion in the `aes::unwrap_key()` function, potentially leading to arbitrary code execution if attacker-controlled buffer sizes are permitted.

openssl aes keywrap oob-write memory-corruption
2r
high advisory

rust-openssl Stack Buffer Overflow Vulnerability

The rust-openssl crate is vulnerable to a stack-based buffer overflow (CVE-2026-41681) where the `EVP_DigestFinal()` function writes beyond the allocated buffer, potentially corrupting the stack, affecting versions >= 0.10.39 and < 0.10.78.

openssl buffer overflow rust vulnerability
2r
high advisory

Heap/Stack Overflow in rust-openssl with OpenSSL 1.1.x

The rust-openssl crate's `Deriver::derive` and `PkeyCtxRef::derive` functions can cause heap/stack overflows when used with OpenSSL 1.1.x due to insufficient buffer length validation in X25519, X448, DH, and HKDF-extract, affecting rust-openssl versions >= 0.9.27 and < 0.10.78.

openssl buffer-overflow rust cryptography
2r