CVE-2026-44662
Description
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This only impacts users using AES key-wrap-with-padding ciphers. This vulnerability is fixed in 0.10.79.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opensslcrates.io | >= 0.10.0, < 0.10.79 | 0.10.79 |
Affected products
26- Range: >= 0.10.0, < 0.10.79
- osv-coords25 versionspkg:apk/chainguard/guestproxyagentpkg:apk/chainguard/sccachepkg:apk/chainguard/sdp-identity-servicepkg:apk/chainguard/sdp-k8s-injectorpkg:apk/chainguard/sqlxpkg:apk/chainguard/typstpkg:apk/chainguard/vectorpkg:apk/wolfi/sccachepkg:apk/wolfi/sdp-identity-servicepkg:apk/wolfi/sdp-k8s-injectorpkg:apk/wolfi/sqlxpkg:apk/wolfi/vectorpkg:rpm/opensuse/afterburn&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/agama&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/agama&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/aws-nitro-enclaves-cli&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/cargo-c&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/libkrun&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-cryptography&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-maturin&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rustup&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sccache&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sdbootutil&distro=openSUSE%20Tumbleweed
< 1.0.44-r0+ 24 more
- (no CPE)range: < 1.0.44-r0
- (no CPE)range: < 0.15.0-r2
- (no CPE)range: < 1.3.10-r7
- (no CPE)range: < 1.3.10-r7
- (no CPE)range: < 0.8.6-r7
- (no CPE)range: < 0.14.2-r8
- (no CPE)range: < 0.55.0-r4
- (no CPE)range: < 0.15.0-r2
- (no CPE)range: < 1.3.10-r7
- (no CPE)range: < 1.3.10-r7
- (no CPE)range: < 0.8.6-r7
- (no CPE)range: < 0.55.0-r4
- (no CPE)range: < 5.10.0.git73.b97f772-160000.1.1
- (no CPE)range: < 17+647.daf9950fc-160000.12.1
- (no CPE)range: < 22+398.d23cf880d-49.1
- (no CPE)range: < 1.4.5~git0.18a5f6f-160000.1.1
- (no CPE)range: < 0.10.23-1.1
- (no CPE)range: < 1.4.10-160000.3.1
- (no CPE)range: < 44.0.3-160000.4.1
- (no CPE)range: < 1.8.7-160000.5.1
- (no CPE)range: < 0.2.9+49-160000.1.1
- (no CPE)range: < 0.2.9+49-1.1
- (no CPE)range: < 1.28.2~0-5.1
- (no CPE)range: < 0.16.0~0-3.1
- (no CPE)range: < 1+git20260713.d869cf8-1.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.