What is the CVSS score of CVE-2026-42327?

CVE-2026-42327 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-42327?

Within 24 hours: Identify all internal applications and dependencies using rust-openssl versions prior to 0.10.79 via package manifests and vulnerability scanning tools. Within 7 days: Upgrade rust-openssl to version 0.10.79 or later and rebuild all affected application binaries; coordinate testing in staging environments to confirm TLS functionality post-update. Within 30 days: Validate patch deployment across all production systems handling certificate validation, conduct regression testing on PKI-dependent workflows, and document remediation in change management systems.

rust-openssl CVE-2026-42327

EUVD-2026-30474 HIGH

Improper Input Validation (CWE-20)

2026-05-05 https://github.com/rust-openssl/rust-openssl

GHSA-xp3w-r5p5-63rr

Information Disclosure OpenSSL Red Hat Suse

8.7

CVSS 4.0 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft X.509 certificate with non-UTF-8 OCSP URL
Delivery

Send certificate to target application (TLS handshake/upload)
Exploit

Application calls X509Ref::ocsp_responders
Execution

Trigger undefined behavior via invalid &str
Persist

Exploit UB consequences (memory corruption/info leak)
Impact

Achieve integrity violation or code execution

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires the target application to process X.509 certificates from untrusted sources AND invoke the X509Ref::ocsp_responders method on those certificates. Specifically: (1) Application must accept certificates over the network (TLS handshakes, certificate upload endpoints, CT log monitors). (2) Application must use rust-openssl versions 0.9.7 through 0.10.78. (3) Application code path must call ocsp_responders to extract OCSP URLs-not all certificate-processing code does this, particularly if OCSP stapling is disabled or validation is delegated externally. (4) The crafted certificate must contain non-UTF-8 bytes in the accessLocation field of an id-ad-ocsp AuthorityInfoAccessSyntax entry. Attack complexity is low (CVSS AC:L) as generating such certificates requires only basic X.509 tooling modifications. No authentication or user interaction required for network-reachable certificate endpoints. However, exploitation impact depends on how the application processes the resulting invalid &str-undefined behavior outcomes vary by compiler version, optimization level, and downstream string operations, making reliable weaponization non-trivial.
Impact	CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation requiring no authentication or user interaction, but impact is limited to high integrity violation (VI:H) with no confidentiality or availability effects in the base score. Real-world risk depends heavily on application context: TLS servers/clients parsing peer certificates during handshakes, certificate transparency monitors, PKI validation tools, and any Rust application calling ocsp_responders on untrusted certificates are vulnerable. No CISA KEV listing and no public POC identified at time of analysis, suggesting exploitation remains theoretical. However, undefined behavior in Rust is notoriously difficult to predict-consequences range from benign panics to exploitable memory corruption depending on compiler optimizations and how the invalid &str propagates through application logic. Patch availability in 0.10.79 makes this a straightforward remediation. Priority should be high for internet-facing certificate processors (TLS terminators, validation services) and medium for internal PKI tooling. The attack vector is simple (present a crafted certificate), but weaponization requires understanding target application's memory layout and how UB manifests post-compilation.
Exploit ScenarioDerived	An attacker presents a maliciously crafted X.509 certificate during a TLS handshake to a Rust-based HTTPS server using rust-openssl 0.10.78. The certificate contains a non-UTF-8 byte sequence (e.g., 0xFF 0xFE invalid UTF-8) in the OCSP responder URL field of the AIA extension. When the server calls ocsp_responders to extract the URL for OCSP stapling or validation, str::from_utf8_unchecked creates an invalid &str. Downstream string operations (length calculation, regex matching, URL parsing) trigger undefined behavior, potentially causing memory corruption that the attacker leverages to bypass certificate validation, leak memory contents, or achieve code execution depending on compiler optimizations and application logic.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – May 14, 2026

Undefined behavior in rust-openssl's X509Ref::ocsp_responders allows crafted X.509 certificates with non-UTF-8 OCSP responder URLs to violate Rust's memory safety guarantees. Applications parsing untrusted certificates (TLS handshakes, certificate validation pipelines, PKI tooling) can trigger undefined behavior through safe Rust code when processing malformed AIA extensions. CVSS 8.7 reflects network-exploitable integrity impact; no active exploitation confirmed (not in CISA KEV), but patch available in version 0.10.79 per upstream GitHub advisory GHSA-xp3w-r5p5-63rr.

Earlier versions of this analysis (1)

v1 May 05, 2026 - 22:30

Memory safety violation in rust-openssl's X509 OCSP responder URL parsing allows attacker-controlled certificates with crafted non-UTF-8 bytes in AIA extensions to trigger undefined behavior in safe Rust code. The vulnerability affects rust-openssl versions 0.9.7 through 0.10.78 and stems from unsafe UTF-8 string construction without validation, potentially enabling memory corruption or information disclosure when processing malicious X.509 certificates. Vendor-released patch available in version 0.10.79 per GitHub Security Advisory GHSA-xp3w-r5p5-63rr. No active exploitation confirmed but attack requires only a crafted certificate processed by vulnerable applications.

RemediationAI

Upgrade rust-openssl to version 0.10.79 or later, which implements proper UTF-8 validation in X509Ref::ocsp_responders before constructing &str references (confirmed fix per GitHub advisory GHSA-xp3w-r5p5-63rr at https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xp3w-r5p5-63rr). Update Cargo.toml dependency specification to openssl = "0.10.79" and run cargo update. For applications that cannot immediately upgrade, implement certificate validation to reject certificates with non-ASCII characters in AIA extensions before processing, though this requires duplicating OpenSSL's X.509 parsing at the application layer. Alternatively, avoid calling ocsp_responders on untrusted certificates and rely on external OCSP validation services, accepting the operational overhead of out-of-band validation. Note that input filtering is fragile since the vulnerability exists in library internals-upgrading is the only complete mitigation. Organizations should audit dependency trees (cargo tree | grep openssl) to identify all affected components, as transitive dependencies may pull vulnerable versions.

Affected VersionsENISA

rust-openssl 0.9.7, < 0.10.79

Affected Packages

cargo openssl fix: 0.10.79

euvd rust_openssl_0_9_7 fix: 0.10.79

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in cargo, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The rust-openssl crate provides Rust bindings to OpenSSL's libssl/libcrypto libraries. The vulnerability exists in the X509Ref::ocsp_responders method, which extracts OCSP responder URLs from X.509 certificates' Authority Information Access (AIA) extension. Per RFC 5280, these URLs are encoded as IA5String, which OpenSSL defines as ASCII (7-bit). However, OpenSSL's implementation does not validate IA5String encoding. The rust-openssl wrapper calls str::from_utf8_unchecked to convert these raw bytes into Rust's &str type without validation. This violates Rust's fundamental invariant that &str must contain valid UTF-8, classified as CWE-20 (Improper Input Validation). Undefined behavior in Rust can enable memory corruption, information disclosure, or arbitrary code execution depending on how downstream code processes the invalid &str. The CPE identifier pkg:rust/openssl covers versions 0.9.7 through 0.10.78, with version 0.10.79 introducing proper UTF-8 validation before dereferencing to &str.

Know when OpenSSL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat 9.1 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

May 14, 2026 - 21:28 vuln.today

v2 - CVSS changed

CVSS changed

May 14, 2026 - 21:22 NVD

8.7 (HIGH)

DescriptionGitHub Advisory

X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant - resulting in undefined behavior.

Executive ViewAI

Why It Matters

A memory safety vulnerability in rust-openssl's X509Ref::ocsp_responders function allows attackers to trigger undefined behavior by submitting crafted X.509 certificates with malformed OCSP responder URLs during TLS handshakes and certificate validation operations. Any organization deploying applications built with affected rust-openssl versions faces integrity compromise risk when processing untrusted certificates from external parties or public infrastructure.

Business Impact: High

Compensating Controls

Apply vendor patch. Upgrade rust-openssl to version 0.10.79 or later immediately. If immediate patching is not feasible, implement network-level controls restricting TLS connections to pre-validated certificate sources and disable processing of untrusted X.509 certificates from external parties until patching is complete.

Threat Intelligence Overview

EPSS Score

0.0%

Top 85% exploitable

Threat Intel

1 source

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2021-3711 CRITICAL Act Now POC

9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2015-4000 LOW Monitor POC

3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
Container suse/sl-micro/6.0/toolbox:latest	Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE	Affected
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back