CVE Intelligence
Analysis AI-assisted

CVE-2026-41677: rust-openssl: out-of-bounds read in PEM password callback

rust-openssl releases from 0.9.0 before 0.10.78 do not validate the length returned by a user password callback used by the *_from_pem_callback APIs. A callback that returns more data than its buffer can make some OpenSSL versions over-read that buffer. The record states the fix is in 0.10.78, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

rust-openssl wraps OpenSSL for Rust applications. The *_from_pem_callback APIs accept a password callback supplied by the application. According to the record, these APIs did not check the length that the callback returns, which leads to an out-of-bounds read (CWE-125).

Impact

  • The NVD base score is 9.1 with a network attack vector, no privileges or user interaction required, high confidentiality impact, no integrity impact and high availability impact.
  • GitHub's assessment in the record is 1.7. The gap between the two scores should be checked against the vendor advisory before prioritizing.
  • SSVC data in the record lists exploitation as none, automatable as no and technical impact as partial.

Affected products and versions

  • rust-openssl from 0.9.0 up to but not including 0.10.78. The record lists two product name entries that carry the same range.
  • The record says the issue is fixed in 0.10.78.
  • The over-read depends on the OpenSSL version underneath rust-openssl. The record says some versions are affected and that newer OpenSSL generations are not.

Exploitation status

The record does not list this CVE in CISA KEV, so no active exploitation is confirmed there. No confirmed exploitation appears in the sources consulted. EPSS data in the record gives a probability of 0.00294 and a percentile of 0.2087.

Remediation and mitigation

  • Upgrade rust-openssl to 0.10.78 or later.
  • Inventory Cargo dependencies to find every project that pulls in a rust-openssl version before 0.10.78, including transitive dependencies.
  • Until upgrading is possible, limit password callbacks to trusted code paths and avoid passing untrusted input through them.

Detection guidance

  • Review dependency lock files and software bills of materials for rust-openssl versions before 0.10.78.
  • Watch for unexpected crashes or memory faults in services that parse PEM material with custom password callbacks.

Limitations of the available information

  • The record does not list the specific OpenSSL versions that are affected.
  • The record's fixes list is empty; the fixed version is taken from the description and the GitHub advisory reference.
  • The two CVSS scores differ and the record does not explain the difference.
  • Only the GitHub advisory is listed as a reference, so further vendor detail was not reviewed.

Frequently asked questions

Which rust-openssl versions are affected by CVE-2026-41677?

According to the record, rust-openssl from 0.9.0 up to but not including 0.10.78 is affected. The fix is stated to be in 0.10.78.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.