rust-openssl CVE-2026-41677
LOW
GHSA-xmgf-hq76-4vx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain password callback control
-
DeliverySupply malicious callback returning oversized length
-
ExploitTrigger PEM load operation
-
ExecutionOver-read buffer memory
-
ImpactExfiltrate adjacent data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application that: (1) uses rust-openssl's |
| Impact | This is an information disclosure vulnerability with moderate real-world risk. The attack surface is narrower than typical remote code execution flaws because exploitation requires either: (1) an application that accepts user-controlled password callbacks, or (2) compromise of the password callback implementation itself. CVSS data is unavailable (marked N/A), preventing direct vector analysis, but CWE-125 (out-of-bounds read) typically results in CVSS scores in the 5.5-7.5 range depending on attack vector and privileges required. The vulnerability is confirmed by a vendor patch and advisory from the rust-openssl project (GitHub GHSA-xmgf-hq76-4vx2), indicating acknowledgment of real impact. The absence of CVSS and EPSS scores, combined with this being a Rust binding issue rather than a widespread OpenSSL client vulnerability, suggests this affects a smaller population than headline OpenSSL CVEs, but applications using rust-openssl with untrusted password callbacks remain at risk of memory disclosure. |
| Exploit ScenarioDerived | An application using rust-openssl to load encrypted PEM private keys with a user-supplied password callback is exploited when the callback is controlled by an attacker (e.g., via deserialized untrusted data or a compromised library). The attacker crafts a callback that returns a length value significantly larger than the actual buffer, causing the OpenSSL library to read adjacent memory. The attacker can then infer secrets (private key material, session data) from the disclosed memory contents. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 23, 2026
Buffer over-read in rust-openssl's password callback APIs allows information disclosure when a user-supplied callback returns a value larger than the provided buffer. The vulnerability affects rust-openssl bindings to OpenSSL 1.x and 2.x; OpenSSL 3.x implementations are not vulnerable. An attacker who controls the password callback can read sensitive data from adjacent memory regions.
RemediationAI
Update rust-openssl to version 0.10.78 or later immediately. This version includes the fix (commit 5af6895c907773699f37f583f409b862284062b1) that validates callback return lengths. Applications should also review password callback implementations to ensure they do not return values exceeding the provided buffer size. If immediate patching is not feasible, restrict the use of password callbacks to trusted code paths only and avoid accepting password callbacks from untrusted sources. The GitHub advisory at https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xmgf-hq76-4vx2 contains detailed guidance.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The rust-openssl crate provides Rust bindings to OpenSSL for cryptographic operations. The *_from_pem_callback APIs accept user-defined password callbacks to decrypt PEM-formatted private keys. The underlying issue is insufficient validation of the length value returned by these callbacks before reading from the caller-supplied buffer. This is a classic buffer over-read (CWE-125) where the callback return value is not bounds-checked against the actual buffer size, allowing reads beyond allocated memory. OpenSSL 3.x fixed this in the native library itself, but rust-openssl versions wrapping OpenSSL 1.x and 2.x inherit the vulnerability.
Know when OpenSSL gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
The *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Exploit-DB