Vulnerability GHSA-hppc-g8h3-xhp3
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
6 months ago
April 22, 2026 at 09:00 PM UTC
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
>=0.9.24 <0.10.78
>=0.9.24 <0.10.78
Summary
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
Details
The FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 months ago
rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
>=0.10.50 <0.10.80 GHSA-phqj-4mhp-q6mq
>=0.10.50 <0.10.80 GHSA-phqj-4mhp-q6mq
Unknown
5 months ago
Buffer overflow with AES key wrap with padding in `cipher_update_inplace`
>=0.10.50 <0.10.80 RUSTSEC-2026-0477
>=0.10.50 <0.10.80 RUSTSEC-2026-0477
Medium Risk
6 months ago
rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
>=0.10.0 <0.10.79 GHSA-xv59-967r-8726
>=0.10.0 <0.10.79 GHSA-xv59-967r-8726
High Risk
6 months ago
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
>=0.9.7 <0.10.79 GHSA-xp3w-r5p5-63rr
>=0.9.7 <0.10.79 GHSA-xp3w-r5p5-63rr
Unknown
6 months ago
`X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8
>=0.9.7 <0.10.79 RUSTSEC-2026-0474
>=0.9.7 <0.10.79 RUSTSEC-2026-0474
Impacted packages
Timeline
Published
6 months ago
April 22, 2026 at 09:00 PM UTC
Fixed (0.10.78)
6 months ago
April 19, 2026 at 08:02 PM UTC
Last Modified
14 hours ago
November 10, 2026 at 02:10 PM UTC