CVE-2026-41898: rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peer
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::setpskclientcallback, setpskservercallback, setcookiegeneratecb, and setstatelesscookiegeneratecb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.
Other sources
The FFI trampolines behind SslContextBuilder::setpskclientcallback, setpskservercallback, setcookiegeneratecb, and setstatelesscookiegeneratecb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/opensslto a version that resolves this vulnerability.Fixed in 0.10.78 - Upgrade
Upgrade
rust-opensslto a version that resolves this vulnerability.Fixed in 0.10.78
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41898?
CVE-2026-41898 is considered a medium severity vulnerability due to its potential to leak adjacent memory to a network peer.
How do I fix CVE-2026-41898?
To fix CVE-2026-41898, you should upgrade rust-openssl to version 0.10.78 or later.
What software is affected by CVE-2026-41898?
CVE-2026-41898 affects rust-openssl versions from 0.9.24 to before 0.10.78.
What type of vulnerability is CVE-2026-41898?
CVE-2026-41898 is an information disclosure vulnerability caused by unchecked callback-returned lengths.
Can CVE-2026-41898 be exploited remotely?
Yes, CVE-2026-41898 can be potentially exploited remotely since it involves leaking memory to a network peer.