---
id: CVE-2026-41676
title: rust-openssl provides OpenSSL bindings for the Rust programming language
summary: >-
  rust-openssl provides OpenSSL bindings for the Rust programming language. 
  From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets
  len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying
  on Ope…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-131
  - CWE-787
vendor: rust-openssl_project
product: rust-openssl
affected:
  - 'rust-openssl >= 0.9.27, < 0.10.78'
patched:
  - rust-openssl 0.10.78
published: '2026-04-24'
updated: '2026-07-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41676'
references:
  - url: >-
      https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00458
epssPercentile: 0.36961
ingestedAt: '2026-07-16T02:48:54.837Z'
---

## Overview

rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

## Affected

- `rust-openssl >= 0.9.27, < 0.10.78`

## Remediation

Upgrade past the affected range:

- `rust-openssl 0.10.78`