~ / search / GHSA-hppc-g8h3-xhp3

GHSA-hppc-g8h3-xhp3

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

Source: GitHub Advisory Database (reviewed) High CVE-2026-41898

Packages

EcosystemPackageAffectedFixed in
crates.io openssl >= 0.9.24, < 0.10.78 0.10.78

Details

As written in the advisory (Markdown source, shown as plain text).

The FFI trampolines behind `SslContextBuilder::set_psk_client_callback`, `set_psk_server_callback`, `set_cookie_generate_cb`, and `set_stateless_cookie_generate_cb` forwarded the user closure's returned usize directly to OpenSSL without checking it against the `&mut [u8]` that was handed to the closure. This can lead to buffer overflows and other unintended consequences.

References

External links from the advisory. They lead to third-party sites.