CVE-2026-41898

Katalog CVE

CVSS 5.3 · Medium EPSS 0,28%

Kerentanan Buffer Over-read pada rust-openssl project rust-openssl. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-126: Buffer Over-read
CWE-130: Improper Handling of Length Parameter Inconsistency

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-hppc-g8h3-xhp3 advisory vendor
• https://github.com/rust-openssl/rust-openssl/commit/1d109020d98fff2fb2e45c39a373af3dff99b24c patch
• https://github.com/rust-openssl/rust-openssl/pull/2607 issue tracking
• https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78 release notes