Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-41898

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.

View on NVD

Analysis

The rust-openssl crate is the standard way to use OpenSSL in Rust, a language gaining significant traction in our community. A CVSS 9.8 memory corruption bug in an FFI layer of a security library is a high-priority risk for any production Rust service.

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-126CWE-130

EPSS

Probability of exploitation (next 30 days): 0.0006 (0.1%)
Percentile: 17.7%
EPSS: 2026-05-06

Affects

rust-openssl_project:rust-openssl

Technical description

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.

Published: 4/24/2026, 6:16:29 PM
Last modified: 4/28/2026, 5:45:23 PM

References

HomeEventsBlogResourcesTeam