Vulnerability GHSA-xmgf-hq76-4vx2
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
6 months ago
April 22, 2026 at 09:20 PM UTC
rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length
0.9.0 - 0.10.77
0.9.0 - 0.10.77
Summary
rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length
Details
The *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 months ago
rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
0.10.50 - 0.10.79 GHSA-phqj-4mhp-q6mq
0.10.50 - 0.10.79 GHSA-phqj-4mhp-q6mq
Medium Risk
6 months ago
rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
0.10.0 - 0.10.78 GHSA-xv59-967r-8726
0.10.0 - 0.10.78 GHSA-xv59-967r-8726
High Risk
6 months ago
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
0.9.7 - 0.10.78 GHSA-xp3w-r5p5-63rr
0.9.7 - 0.10.78 GHSA-xp3w-r5p5-63rr
High Risk
6 months ago
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
0.10.0 - 0.10.77 GHSA-pqf5-4pqq-29f5
0.10.0 - 0.10.77 GHSA-pqf5-4pqq-29f5
High Risk
6 months ago
rust-openssl has incorrect bounds assertion in aes key wrap
0.10.24 - 0.10.77 GHSA-8c75-8mhr-p7r9
0.10.24 - 0.10.77 GHSA-8c75-8mhr-p7r9
Impacted packages
Timeline
Published
6 months ago
April 22, 2026 at 09:20 PM UTC
Fixed (0.10.78)
6 months ago
April 19, 2026 at 08:02 PM UTC
Last Modified
2 months ago
September 10, 2026 at 03:50 AM UTC