{"id":"CVE-2026-41676","title":"rust-openssl provides OpenSSL bindings for the Rust programming language","summary":"rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on Ope…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-131","CWE-787"],"vendor":"rust-openssl_project","product":"rust-openssl","affected":["rust-openssl >= 0.9.27, < 0.10.78"],"patched":["rust-openssl 0.10.78"],"published":"2026-04-24","updated":"2026-07-15","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41676","references":[{"url":"https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00285,"epssPercentile":0.21271,"ingestedAt":"2026-07-16T02:48:54.837Z","slug":"CVE-2026-41676","body":"## Overview\n\nrust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.\n\n## Affected\n\n- `rust-openssl >= 0.9.27, < 0.10.78`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rust-openssl 0.10.78`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}