rust-openssl vulnerabilities
CVEs whose affected-version data names the rust-openssl package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-41678High· 8.1rust-openssl provides OpenSSL bindings for the Rust programming language
rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intende…
CVE-2026-41898Medium· 5.3rust-openssl provides OpenSSL bindings for the Rust programming language
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_sta…
CVE-2026-41681High· 7.5rust-openssl provides OpenSSL bindings for the Rust programming language
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writ…
CVE-2026-41676High· 7.5rust-openssl provides OpenSSL bindings for the Rust programming language
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on Ope…