Skip to content
Threat Feed

Vendor

OpenSSL

3 briefs RSS
high advisory

rust-openssl AES Key Wrap Out-of-Bounds Write Vulnerability

The rust-openssl package is vulnerable to an out-of-bounds write due to an incorrect bounds assertion in the `aes::unwrap_key()` function, potentially leading to arbitrary code execution if attacker-controlled buffer sizes are permitted.

openssl aes keywrap oob-write memory-corruption
2r
high advisory

rust-openssl Stack Buffer Overflow Vulnerability

The rust-openssl crate is vulnerable to a stack-based buffer overflow (CVE-2026-41681) where the `EVP_DigestFinal()` function writes beyond the allocated buffer, potentially corrupting the stack, affecting versions >= 0.10.39 and < 0.10.78.

openssl buffer overflow rust vulnerability
2r
high advisory

Heap/Stack Overflow in rust-openssl with OpenSSL 1.1.x

The rust-openssl crate's `Deriver::derive` and `PkeyCtxRef::derive` functions can cause heap/stack overflows when used with OpenSSL 1.1.x due to insufficient buffer length validation in X25519, X448, DH, and HKDF-extract, affecting rust-openssl versions >= 0.9.27 and < 0.10.78.

openssl buffer-overflow rust cryptography
2r