Skip to main content

rust-openssl CVE-2026-41676

HIGH
Incorrect Calculation of Buffer Size (CWE-131)
2026-04-22 https://github.com/rust-openssl/rust-openssl GHSA-pqf5-4pqq-29f5
Buffer Overflow OpenSSL Suse
7.2
CVSS 4.0 · Vendor: https://github.com/rust-openssl/rust-openssl
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Application accepts key agreement input
  2. Delivery
    Trigger Deriver::derive with undersized buffer
  3. Exploit
    OpenSSL 1.1.x writes full secret beyond buffer
  4. Execution
    Corrupt adjacent stack/heap memory
  5. Impact
    Crash process or achieve memory disclosure

Vulnerability Assessment

Weakness
CWE
CWE-131
ASVS 5.0
V15 - Secure Coding and Architecture Buffer size calculation
Exploitation Conditions

Exploitation requires applications using rust-openssl versions prior to 0.10.78 that explicitly allocate buffers smaller than the cryptographic algorithm's native output size for Deriver::derive or PkeyCtxRef::derive operations, specifically when invoking X25519 (requires buffer <32 bytes), X448 (<56 bytes), Diffie-Hellman (<prime size), or HKDF-extract (<expected output) on systems running OpenSSL 1.1.x libraries. Applications using OpenSSL 3.x are not exploitable as the provider implementations validate buffer lengths. Most production cryptographic code allocates correctly-sized buffers matching algorithm specifications, limiting real-world exposure to custom integrations with undersized buffer allocation logic bugs. Local access is typically required as the attacker must trigger vulnerable key derivation code paths, though network exposure exists if the application performs key agreement based on network-supplied parameters.
Impact

Real-world risk is moderate and highly deployment-specific. The vulnerability only materializes when three conditions align: (1) application code explicitly allocates undersized buffers for key derivation rather than using correctly-sized buffers for the cryptographic algorithm, (2) deployment uses OpenSSL 1.1.x rather than 3.x, and (3) the affected key agreement algorithms (X25519/X448/DH/HKDF-extract) are invoked. Most production cryptographic code allocates buffers matching algorithm specifications (32 bytes for X25519, 56 for X448), making exploitation unlikely in well-architected systems. However, the severity lies in violating Rust's memory safety guarantees from safe code-developers assume buffer indexing via .len() prevents overflows, making this a logic bug that code review might miss. CVSS and EPSS data are absent, preventing quantitative risk scoring. No CISA KEV listing or public exploit code identified at time of analysis, suggesting no widespread exploitation. The primary risk is to custom cryptographic integrations where developers might allocate fixed-size buffers smaller than algorithm outputs, potentially enabling local denial-of-service (stack corruption crash) or theoretically memory disclosure/corruption if heap metadata is adjacent. Upgrade to OpenSSL 3.x inherently mitigates without code changes, but rust-openssl patch provides defense-in-depth by validating buffer sizes at the Rust layer.
Exploit ScenarioDerived

A Rust application using rust-openssl for X25519 key agreement allocates a 16-byte buffer for the shared secret, either due to a logic error or intentional truncation for protocol-specific key derivation. When the application calls Deriver::derive with this undersized buffer on a system running OpenSSL 1.1.x, OpenSSL ignores the 16-byte length hint and writes the full 32-byte X25519 output, overflowing 16 bytes into adjacent stack or heap memory. If the overflow corrupts stack-based return addresses or heap metadata, an attacker controlling key agreement inputs could potentially achieve code execution, though practical exploitation requires precise memory layout knowledge and is more likely to cause denial-of-service crashes.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 23, 2026

Memory corruption in rust-openssl's key derivation functions allows heap or stack buffer overflow when applications pass undersized buffers to Deriver::derive or PkeyCtxRef::derive on OpenSSL 1.1.x. The vulnerability affects X25519, X448, DH, and HKDF-extract operations where OpenSSL ignores the caller-specified buffer length and unconditionally writes the full shared secret, causing safe Rust code to trigger memory corruption. Vendor patch available in v0.10.78; OpenSSL 3.x deployments are not affected as newer providers correctly validate buffer lengths.

RemediationAI

Upgrade rust-openssl to version 0.10.78 or later, released at https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78, which adds buffer size validation before calling EVP_PKEY_derive (fixed in commit 09b425e5f59a2466d806e71a83a9a449c914c596 via PR https://github.com/rust-openssl/rust-openssl/pull/2606). The patch enforces minimum buffer sizes matching algorithm output lengths, preventing OpenSSL from writing beyond allocated boundaries. If immediate upgrade is not feasible, migrate to OpenSSL 3.x libraries which inherently validate buffer lengths in provider implementations, eliminating the overflow condition without code changes. As a temporary workaround, audit all invocations of Deriver::derive and PkeyCtxRef::derive to ensure allocated buffers match or exceed algorithm-specific output sizes: 32 bytes for X25519, 56 bytes for X448, prime size for DH, and expected output length for HKDF-extract. This workaround requires careful code review and offers no programmatic enforcement, making it error-prone for ongoing development. Note that switching to OpenSSL 3.x may introduce compatibility considerations for applications relying on deprecated algorithms or legacy provider behavior.

Affected Packages

cargo openssl fix: 0.10.78

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The rust-openssl crate provides Rust bindings to OpenSSL cryptographic primitives. The Deriver::derive and PkeyCtxRef::derive methods wrap OpenSSL's EVP_PKEY_derive API for key agreement and key derivation operations. The vulnerability stems from behavioral differences between OpenSSL 1.1.x and 3.x in EVP_PKEY_derive implementations. OpenSSL 1.1.x implementations for X25519 (32-byte output), X448 (56-byte output), Diffie-Hellman (prime-size output), and HKDF-extract operations ignore the incoming keylen parameter that specifies buffer capacity, instead unconditionally writing the full derived key material. The rust-openssl binding sets this parameter to buf.len() but does not enforce minimum buffer sizes, creating a CWE-131 (Incorrect Calculation of Buffer Size) condition. When application code allocates a buffer smaller than the algorithm's native output size, OpenSSL writes past the buffer boundary, corrupting adjacent heap or stack memory from within safe Rust code that should be memory-safe by language guarantees. OpenSSL 3.x corrected this by having provider implementations validate keylen before writing, eliminating the overflow risk for deployments using modern OpenSSL versions.

Know when OpenSSL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/rust-openssl/rust-openssl) PRIMARY 7.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
SUSE 6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (https://github.com/rust-openssl/rust-openssl).

CVSS VectorVendor: https://github.com/rust-openssl/rust-openssl

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
CVSS changed
Apr 24, 2026 - 18:22 NVD
7.2 (HIGH)
Patch released
Apr 22, 2026 - 21:46 nvd
Patch available
CVE Published
Apr 22, 2026 - 21:22 nvd
HIGH 7.2

DescriptionCVE.org

Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.

Executive ViewAI

Why It Matters

rust-openssl versions prior to 0.10.78 contain a memory corruption vulnerability in key derivation functions that allows heap or stack buffer overflow when applications use undersized buffers, potentially enabling attackers to corrupt memory and achieve code execution. Organizations using rust-openssl with OpenSSL 1.1.x in cryptographic operations (X25519, X448, DH, HKDF-extract) face immediate risk to application stability and security; OpenSSL 3.x users are not affected.

Business Impact: High
Compensating Controls

Apply vendor patch. Upgrade rust-openssl to version 0.10.78 or later. No interim mitigations available; patch deployment is required to resolve the underlying memory safety issue.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

pkg:rust/openssl

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2021-3711 CRITICAL POC
9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH
7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-131 – Incorrect Calculation of Buffer Size

View all
CVE-2024-23606 CRITICAL POC
9.8
CVE-2021-21824 CRITICAL POC
9.8
CVE-2025-66216 CRITICAL POC
9.3
CVE-2021-21793 HIGH POC
8.8
CVE-2021-21782 HIGH POC
8.8
CVE-2021-21776 HIGH POC
8.8
CVE-2023-0568 HIGH POC
8.1
CVE-2021-29608 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/kiosk/pulseaudio:17.0-72.9 Container suse/kiosk/xorg:21.1-82.9 Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SL-Micro-BYOS-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Affected

References

Advisories & patches
PATCH https://github.com/rust-openssl/rust-openssl/commit/09b425e5f59a2466d806e71a83a9a449c914c596 PATCH https://github.com/rust-openssl/rust-openssl/pull/2606 ADVISORY https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5 ADVISORY https://vuldb.com/vuln/359491 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22554/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22574/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22583/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22589/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22593/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22615/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22624/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22737/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22787/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2777/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2807/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2811/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2825/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2826/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2831/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2832/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2833/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2834/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2835/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2874/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2975/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2976/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2977/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3022/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3026/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3040/ REF https://github.com/advisories/GHSA-pqf5-4pqq-29f5 REF https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy