Tag
rust-openssl Unchecked Callback Length Memory Leak
2 rulesThe rust-openssl crate versions 0.9.24 prior to 0.10.78 are vulnerable to memory leaks due to unchecked callback lengths in PSK/cookie trampolines, potentially leading to buffer overflows.
vcpkg OpenSSL Windows Build Path Vulnerability (CVE-2026-34054)
2 rules 2 TTPs 1 CVEA vulnerability exists in vcpkg versions prior to 3.6.1#3, where Windows builds of OpenSSL set openssldir to a path on the build machine, making that path vulnerable to attack on customer machines.
rust-openssl AES Key Wrap Out-of-Bounds Write Vulnerability
2 rulesThe rust-openssl package is vulnerable to an out-of-bounds write due to an incorrect bounds assertion in the `aes::unwrap_key()` function, potentially leading to arbitrary code execution if attacker-controlled buffer sizes are permitted.
rust-openssl Deriver::derive and PkeyCtxRef::derive Buffer Overflow Vulnerability (CVE-2026-41676)
2 rules 1 CVECVE-2026-41676 is a buffer overflow vulnerability in rust-openssl's Deriver::derive and PkeyCtxRef::derive functions when used with OpenSSL 1.1.1, potentially leading to denial of service or arbitrary code execution.
rust-openssl Stack Buffer Overflow Vulnerability
2 rulesThe rust-openssl crate is vulnerable to a stack-based buffer overflow (CVE-2026-41681) where the `EVP_DigestFinal()` function writes beyond the allocated buffer, potentially corrupting the stack, affecting versions >= 0.10.39 and < 0.10.78.
Heap/Stack Overflow in rust-openssl with OpenSSL 1.1.x
2 rulesThe rust-openssl crate's `Deriver::derive` and `PkeyCtxRef::derive` functions can cause heap/stack overflows when used with OpenSSL 1.1.x due to insufficient buffer length validation in X25519, X448, DH, and HKDF-extract, affecting rust-openssl versions >= 0.9.27 and < 0.10.78.