Home

Description

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.

PUBLISHED Reserved 2026-04-22 | Published 2026-04-24 | Updated 2026-04-24 | Assigner GitHub_M




HIGH: 8.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Problem types

CWE-121: Stack-based Buffer Overflow

Product status

>= 0.10.39, < 0.10.78
affected

References

github.com/...penssl/security/advisories/GHSA-ghm9-cr32-g9qj

github.com/rust-openssl/rust-openssl/pull/2608

github.com/...ommit/826c3888b77add418b394770e2b2e3a72d9f92fe

github.com/...ssl/rust-openssl/releases/tag/openssl-v0.10.78

cve.org (CVE-2026-41681)

nvd.nist.gov (CVE-2026-41681)

Download JSON