High severity7.5NVD Advisory· Published Apr 24, 2026· Updated Jul 15, 2026
CVE-2026-41681
CVE-2026-41681
Description
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opensslcrates.io | >= 0.10.39, < 0.10.78 | 0.10.78 |
Affected products
39- cpe:2.3:a:rust-openssl_project:rust-openssl:*:*:*:*:*:rust:*:*Range: >=0.10.39,<0.10.78
- osv-coords38 versionspkg:apk/chainguard/bootc-binarypkg:apk/chainguard/denopkg:apk/chainguard/guestproxyagentpkg:apk/chainguard/komodo-clipkg:apk/chainguard/komodo-corepkg:apk/chainguard/komodo-peripherypkg:apk/chainguard/rpm-sequoiapkg:apk/chainguard/rustls-openssl-clientpkg:apk/chainguard/rustuppkg:apk/chainguard/sccachepkg:apk/chainguard/sdp-identity-servicepkg:apk/chainguard/sentry-clipkg:apk/chainguard/sqlxpkg:apk/chainguard/typstpkg:apk/chainguard/valkey-ldappkg:apk/chainguard/vectorpkg:apk/chainguard/ztunnel-fips-1.28pkg:apk/chainguard/ztunnel-fips-1.29pkg:apk/wolfi/denopkg:apk/wolfi/rpm-sequoiapkg:apk/wolfi/rustuppkg:apk/wolfi/sccachepkg:apk/wolfi/sdp-identity-servicepkg:apk/wolfi/sqlxpkg:apk/wolfi/vectorpkg:cargo/opensslpkg:rpm/opensuse/afterburn&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/agama&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/aws-nitro-enclaves-cli&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/cargo-c&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/libkrun&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-cryptography&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-maturin&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rustup&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sccache&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sdbootutil&distro=openSUSE%20Tumbleweed
< 1.10.0-r5+ 37 more
- (no CPE)range: < 1.10.0-r5
- (no CPE)range: < 2.7.13-r0
- (no CPE)range: < 1.0.43-r0
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 2.1.2-r2
- (no CPE)range: < 1.10.1-r10
- (no CPE)range: < 1.0.0-r4
- (no CPE)range: < 1.29.0-r5
- (no CPE)range: < 0.14.0-r4
- (no CPE)range: < 1.3.10-r5
- (no CPE)range: < 3.4.0-r0
- (no CPE)range: < 0.8.6-r5
- (no CPE)range: < 0.14.2-r7
- (no CPE)range: < 1.0.0-r5
- (no CPE)range: < 0.55.0-r1
- (no CPE)range: < 1.28.5-r2
- (no CPE)range: < 1.29.1-r3
- (no CPE)range: < 2.7.13-r0
- (no CPE)range: < 1.10.1-r10
- (no CPE)range: < 1.29.0-r5
- (no CPE)range: < 0.14.0-r4
- (no CPE)range: < 1.3.10-r5
- (no CPE)range: < 0.8.6-r5
- (no CPE)range: < 0.55.0-r1
- (no CPE)range: >= 0.10.39, < 0.10.78
- (no CPE)range: < 5.10.0.git73.b97f772-160000.1.1
- (no CPE)range: < 17+647.daf9950fc-160000.12.1
- (no CPE)range: < 1.4.5~git0.18a5f6f-160000.1.1
- (no CPE)range: < 0.10.23-1.1
- (no CPE)range: < 1.4.10-160000.3.1
- (no CPE)range: < 44.0.3-160000.4.1
- (no CPE)range: < 1.8.7-160000.5.1
- (no CPE)range: < 0.2.9+49-160000.1.1
- (no CPE)range: < 0.2.9+49-1.1
- (no CPE)range: < 1.28.2~0-5.1
- (no CPE)range: < 0.16.0~0-3.1
- (no CPE)range: < 1+git20260713.d869cf8-1.1
Patches
Vulnerability mechanics
References
6- github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fenvdPatchWEB
- github.com/advisories/GHSA-ghm9-cr32-g9qjghsaADVISORY
- github.com/rust-openssl/rust-openssl/security/advisories/GHSA-ghm9-cr32-g9qjnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41681ghsaADVISORY
- github.com/rust-openssl/rust-openssl/pull/2608nvdIssue TrackingWEB
- github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.