rust-openssl CVE-2026-41678

Upgrade rust-openssl to version 0.10.78 or later, released by the vendor with the corrected bounds assertion (https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78). The fix is implemented in commit 718d07ff8ff7be417d5b7a6a0a0047f1607520b3b6 and merged via pull request #2604 (https://github.com/rust-openssl/rust-openssl/pull/2604). For applications that cannot immediately upgrade, implement strict validation of buffer sizes before calling aes::unwrap_key() by ensuring output buffer length exactly equals input buffer length minus 8 bytes (out.len() == in_.len() - 8), though this workaround still relies on the vulnerable function and should be considered temporary. Audit all code paths that call aes::unwrap_key() to verify buffer sizes are not derived from untrusted input. Review Cargo.lock to identify dependency chains that may transitively include vulnerable versions.