~ / search / GHSA-xmgf-hq76-4vx2

GHSA-xmgf-hq76-4vx2

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

Source: GitHub Advisory Database (reviewed) Low CVE-2026-41677

Packages

EcosystemPackageAffectedFixed in
crates.io openssl >= 0.9.0, < 0.10.78 0.10.78

Details

As written in the advisory (Markdown source, shown as plain text).

The `*_from_pem_callback` APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.

References

External links from the advisory. They lead to third-party sites.