High severity7.5NVD Advisory· Published Apr 24, 2026· Updated Jul 15, 2026
CVE-2026-41676
CVE-2026-41676
Description
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opensslcrates.io | >= 0.9.27, < 0.10.78 | 0.10.78 |
Affected products
41- cpe:2.3:a:rust-openssl_project:rust-openssl:*:*:*:*:*:rust:*:*Range: >=0.9.27,<0.10.78
- osv-coords40 versionspkg:apk/chainguard/bootc-binarypkg:apk/chainguard/denopkg:apk/chainguard/guestproxyagentpkg:apk/chainguard/komodo-clipkg:apk/chainguard/komodo-corepkg:apk/chainguard/komodo-peripherypkg:apk/chainguard/rpm-sequoiapkg:apk/chainguard/rustls-openssl-clientpkg:apk/chainguard/rustuppkg:apk/chainguard/sccachepkg:apk/chainguard/sdp-identity-servicepkg:apk/chainguard/sentry-clipkg:apk/chainguard/sqlxpkg:apk/chainguard/typstpkg:apk/chainguard/valkey-ldappkg:apk/chainguard/vectorpkg:apk/chainguard/ztunnel-fips-1.28pkg:apk/chainguard/ztunnel-fips-1.29pkg:apk/wolfi/denopkg:apk/wolfi/rpm-sequoiapkg:apk/wolfi/rustuppkg:apk/wolfi/sccachepkg:apk/wolfi/sdp-identity-servicepkg:apk/wolfi/sqlxpkg:apk/wolfi/vectorpkg:cargo/opensslpkg:rpm/opensuse/afterburn&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/afterburn&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/cargo-c&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/clamav&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/clamav&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/libkrun&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-cryptography&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-maturin&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-maturin&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rustup&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sccache&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sdbootutil&distro=openSUSE%20Tumbleweed
< 1.10.0-r5+ 39 more
- (no CPE)range: < 1.10.0-r5
- (no CPE)range: < 2.7.13-r0
- (no CPE)range: < 1.0.43-r0
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 1.10.1-r10
- (no CPE)range: < 1.0.0-r4
- (no CPE)range: < 1.29.0-r5
- (no CPE)range: < 0.14.0-r4
- (no CPE)range: < 1.3.10-r5
- (no CPE)range: < 3.4.0-r0
- (no CPE)range: < 0.8.6-r5
- (no CPE)range: < 0.14.2-r7
- (no CPE)range: < 1.0.0-r5
- (no CPE)range: < 0.55.0-r1
- (no CPE)range: < 1.28.5-r2
- (no CPE)range: < 1.29.1-r3
- (no CPE)range: < 2.7.13-r0
- (no CPE)range: < 1.10.1-r10
- (no CPE)range: < 1.29.0-r5
- (no CPE)range: < 0.14.0-r4
- (no CPE)range: < 1.3.10-r5
- (no CPE)range: < 0.8.6-r5
- (no CPE)range: < 0.55.0-r1
- (no CPE)range: >= 0.9.27, < 0.10.78
- (no CPE)range: < 5.10.0.git73.b97f772-160000.1.1
- (no CPE)range: < 5.10.0.git73.b97f772-1.1
- (no CPE)range: < 0.10.23-1.1
- (no CPE)range: < 1.5.3-160000.1.1
- (no CPE)range: < 1.5.3-1.1
- (no CPE)range: < 1.4.10-160000.3.1
- (no CPE)range: < 44.0.3-160000.4.1
- (no CPE)range: < 1.8.7-160000.5.1
- (no CPE)range: < 1.14.1-1.1
- (no CPE)range: < 0.2.9+49-160000.1.1
- (no CPE)range: < 0.2.9+49-1.1
- (no CPE)range: < 1.28.2~0-4.1
- (no CPE)range: < 0.16.0~0-2.1
- (no CPE)range: < 1+git20260706.f9f4faf-1.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-pqf5-4pqq-29f5ghsaADVISORY
- github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41676ghsaADVISORY
- github.com/rust-openssl/rust-openssl/commit/09b425e5f59a2466d806e71a83a9a449c914c596ghsaWEB
- github.com/rust-openssl/rust-openssl/pull/2606ghsaWEB
- github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78ghsaWEB
News mentions
1- New ClamAV security patch closes seven scanner bugs dating back two decadesHelp Net Security · Jul 5, 2026