High severity7.1GHSA Advisory· Published Jul 17, 2026· Updated Jul 29, 2026
CVE-2026-45784
CVE-2026-45784
Description
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opensslcrates.io | >= 0.10.50, < 0.10.80 | 0.10.80 |
Affected products
46- Range: >= 0.10.50, < 0.10.80
- osv-coords44 versionspkg:apk/chainguard/bootc-binarypkg:apk/chainguard/denopkg:apk/chainguard/guestproxyagentpkg:apk/chainguard/komodo-clipkg:apk/chainguard/komodo-corepkg:apk/chainguard/komodo-peripherypkg:apk/chainguard/rpm-sequoiapkg:apk/chainguard/rustls-openssl-clientpkg:apk/chainguard/rustuppkg:apk/chainguard/sccachepkg:apk/chainguard/sdp-identity-servicepkg:apk/chainguard/sdp-k8s-injectorpkg:apk/chainguard/sentry-clipkg:apk/chainguard/sqlxpkg:apk/chainguard/typstpkg:apk/chainguard/valkey-ldappkg:apk/chainguard/vectorpkg:apk/chainguard/ztunnel-fips-1.28pkg:apk/chainguard/ztunnel-fips-1.29pkg:apk/chainguard/ztunnel-fips-1.30pkg:apk/wolfi/denopkg:apk/wolfi/rpm-sequoiapkg:apk/wolfi/rustuppkg:apk/wolfi/sccachepkg:apk/wolfi/sdp-identity-servicepkg:apk/wolfi/sdp-k8s-injectorpkg:apk/wolfi/sqlxpkg:apk/wolfi/vectorpkg:rpm/opensuse/afterburn&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/afterburn&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/agama&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/agama&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/aws-nitro-enclaves-cli&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/aws-nitro-enclaves-cli&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/cargo-c&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/himmelblau&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-cryptography&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-maturin&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rust-keylime&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rustup&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sccache&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/sdbootutil&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/snpguest&distro=openSUSE%20Leap%2016.0
< 1.15.2-r3+ 43 more
- (no CPE)range: < 1.15.2-r3
- (no CPE)range: < 2.7.14-r4
- (no CPE)range: < 1.0.44-r1
- (no CPE)range: < 2.2.0-r1
- (no CPE)range: < 2.2.0-r1
- (no CPE)range: < 2.2.0-r1
- (no CPE)range: < 1.10.2-r2
- (no CPE)range: < 1.0.0-r7
- (no CPE)range: < 1.29.0-r8
- (no CPE)range: < 0.15.0-r4
- (no CPE)range: < 1.3.11-r0
- (no CPE)range: < 1.3.11-r0
- (no CPE)range: < 3.4.2-r1
- (no CPE)range: < 0.8.6-r9
- (no CPE)range: < 0.14.2-r10
- (no CPE)range: < 1.0.0-r6
- (no CPE)range: < 0.55.0-r6
- (no CPE)range: < 1.28.10-r3
- (no CPE)range: < 1.29.3-r2
- (no CPE)range: < 1.30.0-r2
- (no CPE)range: < 2.7.14-r4
- (no CPE)range: < 1.10.2-r2
- (no CPE)range: < 1.29.0-r8
- (no CPE)range: < 0.15.0-r4
- (no CPE)range: < 1.3.11-r0
- (no CPE)range: < 1.3.11-r0
- (no CPE)range: < 0.8.6-r9
- (no CPE)range: < 0.55.0-r6
- (no CPE)range: < 5.10.0.git73.b97f772-160000.1.1
- (no CPE)range: < 5.10.0.git73.b97f772-1.1
- (no CPE)range: < 17+647.daf9950fc-160000.12.1
- (no CPE)range: < 22+398.d23cf880d-49.1
- (no CPE)range: < 1.4.5~git0.18a5f6f-160000.1.1
- (no CPE)range: < 1.4.5~git0.18a5f6f-1.1
- (no CPE)range: < 0.10.23-1.1
- (no CPE)range: < 2.3.14+git0.e23b4c54-160000.1.1
- (no CPE)range: < 44.0.3-160000.4.1
- (no CPE)range: < 1.8.7-160000.5.1
- (no CPE)range: < 0.2.9+49-160000.1.1
- (no CPE)range: < 0.2.9+49-1.1
- (no CPE)range: < 1.28.2~0-5.1
- (no CPE)range: < 0.16.0~0-3.1
- (no CPE)range: < 1+git20260713.d869cf8-1.1
- (no CPE)range: < 0.10.0-160000.2.1
Patches
Vulnerability mechanics
References
5- github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7nvdPatch
- github.com/rust-openssl/rust-openssl/pull/2638nvdIssue TrackingPatch
- github.com/advisories/GHSA-phqj-4mhp-q6mqghsaADVISORY
- github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mqnvdVendor AdvisoryWEB
- github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.80nvdProductRelease Notes
News mentions
0No linked articles in our index yet.