---
id: RUSTSEC-2026-0286
aliases:
  - GHSA-r6vc-97x9-63vv
title: Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
summary: Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
severity: none
vendor: cryptoki
product: cryptoki
ecosystem: rust
affected:
  - 'cryptoki >= 0.12.0, < 0.12.1'
patched:
  - cryptoki 0.12.1
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T07:45:03.520051741Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0286'
references:
  - url: 'https://crates.io/crates/cryptoki'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0286.html'
  - url: 'https://github.com/parallaxsecond/rust-cryptoki/pull/368'
tags:
  - osv
  - rust
ingestedAt: '2026-09-17T16:20:44.657Z'
---

## Overview

`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a
CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through
the safe `Session::get_attributes` API could cause construction of an
out-of-bounds slice and undefined behavior.

Possible consequences include a process crash or denial of service and
potential disclosure of adjacent heap words. Upgrade to the fixed patch release
for the cryptoki 0.10, 0.11, or 0.12 line.

## Affected packages

- `cryptoki >= 0.12.0, < 0.12.1`

## Remediation

Upgrade to a patched release:

- `cryptoki 0.12.1`