Vulnerability RUSTSEC-2026-0474
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 months ago
May 04, 2026 at 12:00 PM UTC
`X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8
>=0.9.7 <0.10.79
>=0.9.7 <0.10.79
Summary
`X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8
Details
X509Ref::ocsp_responders returns the OCSP responder URLs from a certificate's Authority Information Access extension as OpensslString values, which dereference to str without validating the bytes. OpenSSL does not require these IA5String values to be ASCII, so for a certificate with non-UTF-8 bytes in an OCSP access location, safe code ends up holding a &str that is not valid UTF-8, which is undefined behavior. Certificates often come from untrusted peers.
ocsp_responders was added in 0.9.7. 0.10.79 checks each URL and returns an error if it is not valid UTF-8.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 months ago
rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
>=0.10.50 <0.10.80 GHSA-phqj-4mhp-q6mq
>=0.10.50 <0.10.80 GHSA-phqj-4mhp-q6mq
Unknown
5 months ago
Buffer overflow with AES key wrap with padding in `cipher_update_inplace`
>=0.10.50 <0.10.80 RUSTSEC-2026-0477
>=0.10.50 <0.10.80 RUSTSEC-2026-0477
Medium Risk
6 months ago
rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
>=0.10.0 <0.10.79 GHSA-xv59-967r-8726
>=0.10.0 <0.10.79 GHSA-xv59-967r-8726
High Risk
6 months ago
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
>=0.9.7 <0.10.79 GHSA-xp3w-r5p5-63rr
>=0.9.7 <0.10.79 GHSA-xp3w-r5p5-63rr
Unknown
6 months ago
Buffer overflow with AES key wrap with padding in `cipher_update`
>=0.10.0 <0.10.79 RUSTSEC-2026-0476
>=0.10.0 <0.10.79 RUSTSEC-2026-0476
Impacted packages
Timeline
Published
6 months ago
May 04, 2026 at 12:00 PM UTC
Fixed (0.10.79)
6 months ago
May 04, 2026 at 12:19 AM UTC
Last Modified
14 hours ago
November 10, 2026 at 02:00 PM UTC