CVE-2026-41898 rust-openssl CVE debrief

Who should care

Users of rust-openssl from version 0.9.24 to before 0.10.78 should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing and validating user-provided input to prevent buffer overflows and implementing additional security measures to detect and prevent exploitation. Affected operators, platforms, and security teams should prioritize patching and compensating controls.

Technical summary

The FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb in rust-openssl from 0.9.24 to before 0.10.78 forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. The vulnerability is addressed in rust-openssl version 0.10.78, which includes proper bounds checking and validation.

Defensive priority

High priority due to CVSS score of 8.3 and potential for buffer overflows.

Recommended defensive actions

• Update rust-openssl to version 0.10.78 or later
• Review and validate user-provided input to prevent buffer overflows
• Implement additional security measures to detect and prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is fixed in rust-openssl version 0.10.78. Users should update to this version or later to mitigate the vulnerability. This issue involves buffer overflow risks due to improper validation of user closure returns in SslContextBuilder functions. Defensive verification tasks include reviewing user-provided input and ensuring proper bounds checking. Evidence limits suggest focusing on source-grounded technical framing and known affected scope.

Official resources