CVE-2026-41677: rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the frompemcallback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.
Other sources
The frompemcallback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41677?
CVE-2026-41677 has a moderate severity level due to the potential for buffer over-read vulnerabilities.
How do I fix CVE-2026-41677?
To fix CVE-2026-41677, upgrade the OpenSSL package to version 0.10.79 or later.
Which versions are affected by CVE-2026-41677?
CVE-2026-41677 affects OpenSSL versions from 0.9.0 up to and including 0.10.78.
Does CVE-2026-41677 affect OpenSSL 3.x?
No, CVE-2026-41677 does not affect OpenSSL 3.x versions.
What type of issue does CVE-2026-41677 involve?
CVE-2026-41677 involves an improper validation of the length returned by user callbacks, leading to potential buffer over-read.