CVE catalog

CVE-2026-41676

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out leng

[CVE catalog]

Severity
High · CVSS 7.2
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 23, 2026

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-opensslsid0.10.81-1fixed
Debianrust-opensslforky0.10.81-1fixed
Debianrust-openssltrixie0.10.72-1vulnerable
Debianrust-opensslbookworm0.10.45-1vulnerable
Cperust-opensslNot reportedNot reportedvulnerable
Cperust-opensslNot reported0.10.78fixed
Suserustuplinux enterprise server 16.01.29.1~0-160000.1.1fixed
Suserustuplinux enterprise server for sap applications 16.01.29.1~0-160000.1.1fixed
Opensusesdbootutilleap 16.01+git20260908.c641fc2-160000.1.1fixed
Susehimmelblaulinux enterprise high performance computing 15 sp5-espos2.3.14+git0.e23b4c54-150500.11.12.1fixed
Susehimmelblaulinux enterprise high performance computing 15 sp5-ltss2.3.14+git0.e23b4c54-150500.11.12.1fixed
Susehimmelblaulinux enterprise server 15 sp5-ltss2.3.14+git0.e23b4c54-150500.11.12.1fixed
Susehimmelblaulinux enterprise server 15 sp6-ltss2.3.14+git0.e23b4c54-150500.11.12.1fixed
Susehimmelblaulinux enterprise server for sap applications 15 sp52.3.14+git0.e23b4c54-150500.11.12.1fixed
Susehimmelblaulinux enterprise server for sap applications 15 sp62.3.14+git0.e23b4c54-150500.11.12.1fixed
Suses390-toolslinux enterprise micro 5.32.31.0-150400.7.34.1fixed
Suses390-toolslinux enterprise micro 5.42.31.0-150400.7.34.1fixed
Suses390-toolslinux enterprise micro 5.52.31.0-150500.9.32.1fixed
Suses390-toolslinux micro 6.12.31.0-slfo.1.1_4.1fixed
Suserust-keylimelinux micro 6.10.2.9+49-slfo.1.1_1.1fixed
Susepython-cryptographylinux micro 6.142.0.4-slfo.1.1_5.1fixed
Suserust-keylimelinux micro 6.00.2.9+49-1.1fixed
Susepython-cryptographylinux micro 6.042.0.4-5.1fixed
Suses390-toolslinux micro 6.02.31.0-4.1fixed
Susepython-cryptographylinux enterprise server 16.044.0.3-160000.4.1fixed
Susepython-cryptographylinux enterprise server for sap applications 16.044.0.3-160000.4.1fixed
Susepython-maturinlinux enterprise server 16.01.8.7-160000.5.1fixed
Susepython-maturinlinux enterprise server for sap applications 16.01.8.7-160000.5.1fixed
Susepython-cryptographylinux micro 6.244.0.3-160000.4.1fixed
Susepython-maturinlinux micro 6.21.8.7-160000.5.1fixed
Susepython-cryptographylinux enterprise module for public cloud 15 sp441.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp4-espos41.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp4-ltss41.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp5-espos41.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp5-ltss41.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise server 15 sp4-ltss41.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise server 15 sp5-ltss41.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise server for sap applications 15 sp441.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise server for sap applications 15 sp541.0.3-150400.16.25.1fixed
Susepython-cryptographylinux enterprise module for python 3 15 sp741.0.3-150600.23.9.1fixed
Susepython-cryptographylinux enterprise server 15 sp6-ltss41.0.3-150600.23.9.1fixed
Susepython-cryptographylinux enterprise server for sap applications 15 sp641.0.3-150600.23.9.1fixed
Suserust-keylimelinux enterprise server 16.00.2.9+49-160000.1.1fixed
Suserust-keylimelinux enterprise server for sap applications 16.00.2.9+49-160000.1.1fixed
Suserust-keylimelinux micro 6.20.2.9+49-160000.1.1fixed
Opensusepython-cryptographyleap 16.044.0.3-160000.4.1fixed
Opensusepython-maturinleap 16.01.8.7-160000.5.1fixed
Opensuserust-keylimeleap 16.00.2.9+49-160000.1.1fixed
Opensusepython-maturintumbleweed1.14.1-1.1fixed
Suserust-keylimelinux enterprise micro 5.40.2.9+49-150400.3.19.1fixed
Suserust-keylimelinux enterprise micro 5.30.2.9+49-150400.3.21.1fixed
Suserust-keylimelinux enterprise micro 5.50.2.9+49-150500.3.19.1fixed
Opensusecargo-ctumbleweed0.10.23-1.1fixed
Opensuserust-keylimetumbleweed0.2.9+49-1.1fixed
Opensusesccachetumbleweed0.16.0~0-2.1fixed
Opensuserustuptumbleweed1.28.2~0-4.1fixed
Opensusesdbootutiltumbleweed1+git20260706.f9f4faf-1.1fixed
Susecryptsetuplinux enterprise module for basesystem 15 sp72.8.4-150700.6.4.4fixed
Suses390-toolslinux enterprise module for basesystem 15 sp72.41.0-150700.4.26.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-opensslsourcesid0.10.78-1not yet assignedNot reported[1134881]
Debianrust-opensslsourceforky0.10.78-1not yet assignedNot reported[1134881]
Debianrust-opensslsourcetrixie(unfixed)not yet assignedNot reported[1134881]
Debianrust-opensslsourcebookworm(unfixed)not yet assignedNot reported[1134881]
Cperust-opensslcpeNot reported0.10.78Not reportedNot reportedNot reported
Suserustuprpmlinux enterprise server 16.01.29.1~0-160000.1.1Not reportedSUSE-SU-2026:24014-1Not reported
Suserustuprpmlinux enterprise server for sap applications 16.01.29.1~0-160000.1.1Not reportedSUSE-SU-2026:24014-1Not reported
Opensusesdbootutilrpmleap 16.01+git20260908.c641fc2-160000.1.1Not reportedOPENSUSE-SU-2026:21933-1Not reported
Susehimmelblaurpmlinux enterprise high performance computing 15 sp5-espos2.3.14+git0.e23b4c54-150500.11.12.1Not reportedSUSE-SU-2026:3576-1Not reported
Susehimmelblaurpmlinux enterprise high performance computing 15 sp5-ltss2.3.14+git0.e23b4c54-150500.11.12.1Not reportedSUSE-SU-2026:3576-1Not reported
Susehimmelblaurpmlinux enterprise server 15 sp5-ltss2.3.14+git0.e23b4c54-150500.11.12.1Not reportedSUSE-SU-2026:3576-1Not reported
Susehimmelblaurpmlinux enterprise server 15 sp6-ltss2.3.14+git0.e23b4c54-150500.11.12.1Not reportedSUSE-SU-2026:3576-1Not reported
Susehimmelblaurpmlinux enterprise server for sap applications 15 sp52.3.14+git0.e23b4c54-150500.11.12.1Not reportedSUSE-SU-2026:3576-1Not reported
Susehimmelblaurpmlinux enterprise server for sap applications 15 sp62.3.14+git0.e23b4c54-150500.11.12.1Not reportedSUSE-SU-2026:3576-1Not reported
Suses390-toolsrpmlinux enterprise micro 5.32.31.0-150400.7.34.1Not reportedSUSE-SU-2026:3474-1Not reported
Suses390-toolsrpmlinux enterprise micro 5.42.31.0-150400.7.34.1Not reportedSUSE-SU-2026:3474-1Not reported
Suses390-toolsrpmlinux enterprise micro 5.52.31.0-150500.9.32.1Not reportedSUSE-SU-2026:3475-1Not reported
Suses390-toolsrpmlinux micro 6.12.31.0-slfo.1.1_4.1Not reportedSUSE-SU-2026:22910-1Not reported
Suserust-keylimerpmlinux micro 6.10.2.9+49-slfo.1.1_1.1Not reportedSUSE-SU-2026:22898-1Not reported
Susepython-cryptographyrpmlinux micro 6.142.0.4-slfo.1.1_5.1Not reportedSUSE-SU-2026:22895-1Not reported
Suserust-keylimerpmlinux micro 6.00.2.9+49-1.1Not reportedSUSE-SU-2026:22921-1Not reported
Susepython-cryptographyrpmlinux micro 6.042.0.4-5.1Not reportedSUSE-SU-2026:22801-1Not reported
Suses390-toolsrpmlinux micro 6.02.31.0-4.1Not reportedSUSE-SU-2026:22737-1Not reported
Susepython-cryptographyrpmlinux enterprise server 16.044.0.3-160000.4.1Not reportedSUSE-SU-2026:22624-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 16.044.0.3-160000.4.1Not reportedSUSE-SU-2026:22624-1Not reported
Susepython-maturinrpmlinux enterprise server 16.01.8.7-160000.5.1Not reportedSUSE-SU-2026:22615-1Not reported
Susepython-maturinrpmlinux enterprise server for sap applications 16.01.8.7-160000.5.1Not reportedSUSE-SU-2026:22615-1Not reported
Susepython-cryptographyrpmlinux micro 6.244.0.3-160000.4.1Not reportedSUSE-SU-2026:22593-1Not reported
Susepython-maturinrpmlinux micro 6.21.8.7-160000.5.1Not reportedSUSE-SU-2026:22589-1Not reported
Susepython-cryptographyrpmlinux enterprise module for public cloud 15 sp441.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp4-espos41.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp4-ltss41.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp5-espos41.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp5-ltss41.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise server 15 sp4-ltss41.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise server 15 sp5-ltss41.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 15 sp441.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 15 sp541.0.3-150400.16.25.1Not reportedSUSE-SU-2026:3040-1Not reported
Susepython-cryptographyrpmlinux enterprise module for python 3 15 sp741.0.3-150600.23.9.1Not reportedSUSE-SU-2026:3026-1Not reported
Susepython-cryptographyrpmlinux enterprise server 15 sp6-ltss41.0.3-150600.23.9.1Not reportedSUSE-SU-2026:3026-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 15 sp641.0.3-150600.23.9.1Not reportedSUSE-SU-2026:3026-1Not reported
Suserust-keylimerpmlinux enterprise server 16.00.2.9+49-160000.1.1Not reportedSUSE-SU-2026:22583-1Not reported
Suserust-keylimerpmlinux enterprise server for sap applications 16.00.2.9+49-160000.1.1Not reportedSUSE-SU-2026:22583-1Not reported
Suserust-keylimerpmlinux micro 6.20.2.9+49-160000.1.1Not reportedSUSE-SU-2026:22554-1Not reported
Opensusepython-cryptographyrpmleap 16.044.0.3-160000.4.1Not reportedOPENSUSE-SU-2026:21294-1Not reported
Opensusepython-maturinrpmleap 16.01.8.7-160000.5.1Not reportedOPENSUSE-SU-2026:21285-1Not reported
Opensuserust-keylimerpmleap 16.00.2.9+49-160000.1.1Not reportedOPENSUSE-SU-2026:21274-1Not reported
Opensusepython-maturinrpmtumbleweed1.14.1-1.1Not reportedOPENSUSE-SU-2026:11237-1Not reported
Suserust-keylimerpmlinux enterprise micro 5.40.2.9+49-150400.3.19.1Not reportedSUSE-SU-2026:2826-1Not reported
Suserust-keylimerpmlinux enterprise micro 5.30.2.9+49-150400.3.21.1Not reportedSUSE-SU-2026:2825-1Not reported
Suserust-keylimerpmlinux enterprise micro 5.50.2.9+49-150500.3.19.1Not reportedSUSE-SU-2026:2807-1Not reported
Opensusecargo-crpmtumbleweed0.10.23-1.1Not reportedOPENSUSE-SU-2026:11210-1Not reported
Opensuserust-keylimerpmtumbleweed0.2.9+49-1.1Not reportedOPENSUSE-SU-2026:11222-1Not reported
Opensusesccacherpmtumbleweed0.16.0~0-2.1Not reportedOPENSUSE-SU-2026:11206-1Not reported
Opensuserustuprpmtumbleweed1.28.2~0-4.1Not reportedOPENSUSE-SU-2026:11205-1Not reported
Opensusesdbootutilrpmtumbleweed1+git20260706.f9f4faf-1.1Not reportedOPENSUSE-SU-2026:11194-1Not reported
Susecryptsetuprpmlinux enterprise module for basesystem 15 sp72.8.4-150700.6.4.4Not reportedSUSE-SU-2026:2777-1Not reported
Suses390-toolsrpmlinux enterprise module for basesystem 15 sp72.41.0-150700.4.26.2Not reportedSUSE-SU-2026:2777-1Not reported

[Debian bug #1134881]

Notes

[trixie] rust-openssl: Minor issue [bookworm] rust-openssl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [librust-openssl-dev]Affected

    Source package: [rust-openssl]

    Details (2)

    • 0.10.45-1 · amd64 · bookworm

      Affected

      nvd · rust-openssl · debian · bookworm; nvd · rust-openssl · debian · 12

    • 0.10.45-1 · arm64 · bookworm

      Affected

      nvd · rust-openssl · debian · bookworm; nvd · rust-openssl · debian · 12

[Debian 13 (Trixie)]

  • [librust-openssl-dev]Affected

    Source package: [rust-openssl]

    Details (2)

    • 0.10.72-1 · amd64 · trixie

      Affected

      nvd · rust-openssl · debian · 13

    • 0.10.72-1 · arm64 · trixie

      Affected

      nvd · rust-openssl · debian · 13

[openSUSE Tumbleweed]

  • [keylime-ima-policy]Unknown

    Source package: [rust-keylime]

    Details (1)

    • 0.2.9+49-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 0.2.9+49-1.1

      Version impact unknown

      nvd · rust-keylime · opensuse · tumbleweed

  • [python313-maturin]Unknown

    Source package: [python-maturin]

    Details (1)

    • 1.14.1-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.14.1-1.1

      Version impact unknown

      nvd · python-maturin · opensuse · tumbleweed

  • [python314-maturin]Unknown

    Source package: [python-maturin]

    Details (1)

    • 1.14.1-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.14.1-1.1

      Version impact unknown

      nvd · python-maturin · opensuse · tumbleweed

  • [sdbootutil-bash-completion]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [sdbootutil-dracut-measure-pcr]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [sdbootutil-enroll]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [sdbootutil-jeos-firstboot-enroll]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [sdbootutil-kernel-install]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [sdbootutil-snapper]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [sdbootutil-tukit]Unknown

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1+git20260706.f9f4faf-1.1

      Version impact unknown

      nvd · sdbootutil · opensuse · tumbleweed

  • [cargo-c]Fixed

    Source package: [cargo-c]

    Details (1)

    • 0.10.23-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.10.23-1.1

      nvd · cargo-c · opensuse · tumbleweed

  • [rust-keylime]Fixed

    Source package: [rust-keylime]

    Details (1)

    • 0.2.9+49-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 0.2.9+49-1.1

      nvd · rust-keylime · opensuse · tumbleweed

  • [rustup]Fixed

    Source package: [rustup]

    Details (1)

    • 1.29.0~0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.28.2~0-4.1

      nvd · rustup · opensuse · tumbleweed

  • [sccache]Fixed

    Source package: [sccache]

    Details (1)

    • 0.17.0~1-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.16.0~0-2.1

      nvd · sccache · opensuse · tumbleweed

  • [sdbootutil]Fixed

    Source package: [sdbootutil]

    Details (1)

    • 1+git20260825.c7a5a97-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1+git20260706.f9f4faf-1.1

      nvd · sdbootutil · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]