SB2026042021 - Multiple vulnerabilities in rust-openssl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042021

SB2026042021 - Multiple vulnerabilities in rust-openssl

Published: April 20, 2026

Security Bulletin ID SB2026042021
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: N/A)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper bounds checking in the FFI trampolines for SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb when forwarding callback-returned lengths to OpenSSL. A remote attacker can trigger processing of a callback that returns an excessive length to disclose sensitive information.

The issue stems from passing the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] buffer provided to the closure.


2) Stack-based buffer overflow (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in MdCtxRef::digest_final() when processing a caller-supplied output buffer. A remote attacker can trigger the function with an undersized output buffer to cause memory corruption.

This issue is reachable from safe Rust.


3) Out-of-bounds write (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to out-of-bounds write in aes::unwrap_key() when processing attacker-controlled buffer sizes. A remote attacker can provide a buffer that is smaller than required to cause memory corruption.

The issue stems from an inverted bounds assertion on the output buffer size in a safe public function.


4) Out-of-bounds read (CVE-ID: N/A)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the *_from_pem_callback APIs when processing a user-supplied password callback result. A remote attacker can supply a callback that returns an oversized length to disclose sensitive information.

Only some versions of OpenSSL are affected, and OpenSSL 3.x is not affected.


5) Out-of-bounds write (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause a buffer overflow.

The vulnerability exists due to a heap/stack overflow in Deriver::derive and PkeyCtxRef::derive when deriving shared secrets into a caller-supplied buffer on OpenSSL 1.1.x. A remote attacker can provide or trigger use of a short buffer to cause a buffer overflow.

Only OpenSSL 1.1.x is affected; OpenSSL 3.x providers check the buffer length.


Remediation

Install update from vendor's website.

References