CVE-2026-45784 is a vulnerability in rust-openssl, specifically in the CipherCtxRef::cipher_update_inplace function. From version 0.10.50 to 0.10.79, this function incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. This could lead to up to 7 bytes being written past the end of the caller's buffer or Vec for non-multiple-of-8 inputs, resulting [truncated]
The CVE record for CVE-2026-41898 was published on 2026-04-24T18:16:29.860Z. The vulnerability affects rust-openssl versions from 0.9.24 to before 0.10.78. It involves improper forwarding of user closure returns to OpenSSL, potentially leading to buffer overflows. This issue has a high CVSS score of 8.3, indicating a high severity vulnerability. Users of affected versions should be aware and take necessar [truncated]
CVE-2026-41681 is a high-severity vulnerability in Rust-OpenSSL, a Rust library providing OpenSSL bindings. The vulnerability, fixed in version 0.10.78, allows for a buffer overflow due to EVP_DigestFinal() always writing EVP_MD_CTX_size(ctx) to the out buffer, potentially corrupting the stack. This issue is reachable from safe Rust and has a CVSS score of 8.1. The vulnerability affects versions from 0.10 [truncated]
The CVE record for CVE-2026-41678 was published on 2026-04-24T18:16:29.420Z. This vulnerability affects the rust-openssl library, specifically versions before 0.10.78. The aes::unwrap_key() function contains an incorrect assertion that can lead to an out-of-bounds write if a smaller buffer is provided. This issue is classified as HIGH severity with a CVSS score of 7.2. Users of the Rust-OpenSSL library, p [truncated]
