CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-41676

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 12.7%

CVSS Severity

CVSS v3 Score 9.8

References

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5

Products affected by CVE-2026-41676

Rust-Openssl Project » Rust-Openssl » Version: 0.10.0

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.0
Rust-Openssl Project » Rust-Openssl » Version: 0.10.1

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.1
Rust-Openssl Project » Rust-Openssl » Version: 0.10.10

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.10
Rust-Openssl Project » Rust-Openssl » Version: 0.10.11

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.11
Rust-Openssl Project » Rust-Openssl » Version: 0.10.12

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.12
Rust-Openssl Project » Rust-Openssl » Version: 0.10.13

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.13
Rust-Openssl Project » Rust-Openssl » Version: 0.10.14

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.14
Rust-Openssl Project » Rust-Openssl » Version: 0.10.15

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.15
Rust-Openssl Project » Rust-Openssl » Version: 0.10.16

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.16
Rust-Openssl Project » Rust-Openssl » Version: 0.10.17

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.17
Rust-Openssl Project » Rust-Openssl » Version: 0.10.18

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.18
Rust-Openssl Project » Rust-Openssl » Version: 0.10.19

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.19
Rust-Openssl Project » Rust-Openssl » Version: 0.10.2

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.2
Rust-Openssl Project » Rust-Openssl » Version: 0.10.20

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.20
Rust-Openssl Project » Rust-Openssl » Version: 0.10.21

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.21
Rust-Openssl Project » Rust-Openssl » Version: 0.10.22

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.22
Rust-Openssl Project » Rust-Openssl » Version: 0.10.23

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.23
Rust-Openssl Project » Rust-Openssl » Version: 0.10.24

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.24
Rust-Openssl Project » Rust-Openssl » Version: 0.10.3

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.3
Rust-Openssl Project » Rust-Openssl » Version: 0.10.4

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.4
Rust-Openssl Project » Rust-Openssl » Version: 0.10.5

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.5
Rust-Openssl Project » Rust-Openssl » Version: 0.10.6

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.6
Rust-Openssl Project » Rust-Openssl » Version: 0.10.7

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.7
Rust-Openssl Project » Rust-Openssl » Version: 0.10.8

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.8
Rust-Openssl Project » Rust-Openssl » Version: 0.10.9

cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.9
Rust-Openssl Project » Rust-Openssl » Version: 0.9.27

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.27
Rust-Openssl Project » Rust-Openssl » Version: 0.9.28

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.28
Rust-Openssl Project » Rust-Openssl » Version: 0.9.30

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.30
Rust-Openssl Project » Rust-Openssl » Version: 0.9.31

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.31
Rust-Openssl Project » Rust-Openssl » Version: 0.9.32

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.32
Rust-Openssl Project » Rust-Openssl » Version: 0.9.33

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.33
Rust-Openssl Project » Rust-Openssl » Version: 0.9.35

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.35
Rust-Openssl Project » Rust-Openssl » Version: 0.9.36

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.36
Rust-Openssl Project » Rust-Openssl » Version: 0.9.37

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.37
Rust-Openssl Project » Rust-Openssl » Version: 0.9.38

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.38
Rust-Openssl Project » Rust-Openssl » Version: 0.9.39

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.39
Rust-Openssl Project » Rust-Openssl » Version: 0.9.40

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.40
Rust-Openssl Project » Rust-Openssl » Version: 0.9.41

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.41
Rust-Openssl Project » Rust-Openssl » Version: 0.9.42

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.42
Rust-Openssl Project » Rust-Openssl » Version: 0.9.43

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.43
Rust-Openssl Project » Rust-Openssl » Version: 0.9.44

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.44
Rust-Openssl Project » Rust-Openssl » Version: 0.9.45

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.45
Rust-Openssl Project » Rust-Openssl » Version: 0.9.46

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.46
Rust-Openssl Project » Rust-Openssl » Version: 0.9.47

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.47
Rust-Openssl Project » Rust-Openssl » Version: 0.9.48

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.48
Rust-Openssl Project » Rust-Openssl » Version: 0.9.49

cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.49

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-41676

Products

Pricing

Contact Us