Critical severity9.1NVD Advisory· Published Apr 24, 2026· Updated Apr 28, 2026
CVE-2026-41677
CVE-2026-41677
Description
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opensslcrates.io | >= 0.9.0, < 0.10.78 | 0.10.78 |
Affected products
27- cpe:2.3:a:rust-openssl_project:rust-openssl:*:*:*:*:*:rust:*:*Range: >=0.9.0,<0.10.78
- osv-coords26 versionspkg:apk/chainguard/bootc-binarypkg:apk/chainguard/denopkg:apk/chainguard/guestproxyagentpkg:apk/chainguard/komodo-clipkg:apk/chainguard/komodo-corepkg:apk/chainguard/komodo-peripherypkg:apk/chainguard/rpm-sequoiapkg:apk/chainguard/rustls-openssl-clientpkg:apk/chainguard/rustuppkg:apk/chainguard/sccachepkg:apk/chainguard/sdp-identity-servicepkg:apk/chainguard/sentry-clipkg:apk/chainguard/sqlxpkg:apk/chainguard/typstpkg:apk/chainguard/valkey-ldappkg:apk/chainguard/vectorpkg:apk/chainguard/ztunnel-fips-1.28pkg:apk/chainguard/ztunnel-fips-1.29pkg:apk/wolfi/denopkg:apk/wolfi/rpm-sequoiapkg:apk/wolfi/rustuppkg:apk/wolfi/sccachepkg:apk/wolfi/sdp-identity-servicepkg:apk/wolfi/sqlxpkg:apk/wolfi/vectorpkg:cargo/openssl
< 1.10.0-r5+ 25 more
- (no CPE)range: < 1.10.0-r5
- (no CPE)range: < 2.7.13-r0
- (no CPE)range: < 1.0.43-r0
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 1.10.1-r10
- (no CPE)range: < 1.0.0-r4
- (no CPE)range: < 1.29.0-r5
- (no CPE)range: < 0.14.0-r4
- (no CPE)range: < 1.3.10-r5
- (no CPE)range: < 3.4.0-r0
- (no CPE)range: < 0.8.6-r5
- (no CPE)range: < 0.14.2-r7
- (no CPE)range: < 1.0.0-r5
- (no CPE)range: < 0.55.0-r1
- (no CPE)range: < 1.28.5-r2
- (no CPE)range: < 1.29.1-r3
- (no CPE)range: < 2.7.13-r0
- (no CPE)range: < 1.10.1-r10
- (no CPE)range: < 1.29.0-r5
- (no CPE)range: < 0.14.0-r4
- (no CPE)range: < 1.3.10-r5
- (no CPE)range: < 0.8.6-r5
- (no CPE)range: < 0.55.0-r1
- (no CPE)range: >= 0.9.0, < 0.10.78
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-xmgf-hq76-4vx2ghsaADVISORY
- github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xmgf-hq76-4vx2nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41677ghsaADVISORY
- github.com/rust-openssl/rust-openssl/commit/5af6895c907773699f37f583f409b862284062b1ghsaWEB
- github.com/rust-openssl/rust-openssl/pull/2605ghsaWEB
- github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78ghsaWEB
News mentions
0No linked articles in our index yet.