{"id":"CVE-2025-24898","title":"rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)","summary":"A flaw was found in the rust-openssl package. In certain versions, `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever`…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","cvssSource":"vendor","cwe":"CWE-416","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 9)","affected":["enterprise_linux 10","enterprise_linux 9","enterprise_linux_appstream_v_9"],"patched":["enterprise_linux_appstream_v_9"],"published":"2025-02-03","updated":"2026-10-13","sourceUpdated":"2026-10-13T21:12:33+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24898.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24898.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-24898"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2343573"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24898"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24898"},{"url":"https://crates.io/crates/openssl"},{"url":"https://github.com/sfackler/rust-openssl/pull/2360"},{"url":"https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm"},{"url":"https://access.redhat.com/errata/RHSA-2025:7160"},{"url":"https://access.redhat.com/errata/RHSA-2025:7241"},{"url":"https://access.redhat.com/errata/RHSA-2025:7313"},{"url":"https://access.redhat.com/errata/RHSA-2025:7317"},{"url":"https://access.redhat.com/errata/RHSA-2025:7147"},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0004.html"}],"tags":["csaf","vex","red-hat","osv","rust"],"epss":0.0068,"epssPercentile":0.52216,"aliases":["RUSTSEC-2025-0004","GHSA-rpmj-rpgj-qmpm"],"ecosystem":"rust","ingestedAt":"2026-10-13T11:45:30.176Z","slug":"CVE-2025-24898","body":"## Overview\n\nA flaw was found in the rust-openssl package. In certain versions, `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use-after-free error. This could cause the server to crash or return arbitrary memory contents to the client.\n\n## Vendor advisories\n\n- **RHSA-2025:7160** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7160)\n- **RHSA-2025:7241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7241)\n- **RHSA-2025:7313** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7313)\n- **RHSA-2025:7317** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7317)\n- **RHSA-2025:7147** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7147)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10 · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24898.json)\n\n**rust-openssl: rust openssl ssl::select_next_proto use after free** — rated Moderate by Red Hat. Released 2025-02-03, updated 2026-10-13.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 9)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux 10\n\nNot affected:\n\n- Red Hat Directory Server 11\n- Red Hat Directory Server 12\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7160\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7241\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7313\n\nWorkarounds / mitigations:\n\n- Users should upgrade to an available vendor-provided update. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2025-24898)\n\nAffected packages:\n\n- `openssl >= 0.0.0-0, < 0.10.70`\n\nPatched in:\n\n- `openssl 0.10.70`\n\nSource: https://osv.dev/vulnerability/RUSTSEC-2025-0004","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":220103,"id":"CVE-2025-24898","ts":1791978539039,"field":"cvss","old":null,"new":"4.8"},{"seq":220102,"id":"CVE-2025-24898","ts":1791978539039,"field":"severity","old":"none","new":"medium"}]}