---
id: CVE-2025-24898
title: >-
  rust-openssl: rust openssl ssl::select_next_proto use after free
  (CVE-2025-24898)
summary: >-
  A flaw was found in the rust-openssl package. In certain versions,
  `ssl::select_next_proto` can return a slice pointing into the `server`
  argument's buffer but with a lifetime bound to the `client` argument. In
  situations where the `sever`…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'
cvssSource: vendor
cwe: CWE-416
vendor: Red Hat
product: Red Hat Enterprise Linux AppStream (v. 9)
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_appstream_v_9
patched:
  - enterprise_linux_appstream_v_9
published: '2025-02-03'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T21:12:33+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24898.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24898.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-24898'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2343573'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-24898'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-24898'
  - url: 'https://crates.io/crates/openssl'
  - url: 'https://github.com/sfackler/rust-openssl/pull/2360'
  - url: >-
      https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm
  - url: 'https://access.redhat.com/errata/RHSA-2025:7160'
  - url: 'https://access.redhat.com/errata/RHSA-2025:7241'
  - url: 'https://access.redhat.com/errata/RHSA-2025:7313'
  - url: 'https://access.redhat.com/errata/RHSA-2025:7317'
  - url: 'https://access.redhat.com/errata/RHSA-2025:7147'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0004.html'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - rust
epss: 0.0068
epssPercentile: 0.52216
aliases:
  - RUSTSEC-2025-0004
  - GHSA-rpmj-rpgj-qmpm
ecosystem: rust
ingestedAt: '2026-10-13T11:45:30.176Z'
---

## Overview

A flaw was found in the rust-openssl package. In certain versions, `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use-after-free error. This could cause the server to crash or return arbitrary memory contents to the client.

## Vendor advisories

- **RHSA-2025:7160** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7160)
- **RHSA-2025:7241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7241)
- **RHSA-2025:7313** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7313)
- **RHSA-2025:7317** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7317)
- **RHSA-2025:7147** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7147)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10 · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24898.json)

**rust-openssl: rust openssl ssl::select_next_proto use after free** — rated Moderate by Red Hat. Released 2025-02-03, updated 2026-10-13.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

Fixed:

- Red Hat Enterprise Linux AppStream (v. 9)

No fix planned:

- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10

Not affected:

- Red Hat Directory Server 11
- Red Hat Directory Server 12
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7160
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7241
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7313

Workarounds / mitigations:

- Users should upgrade to an available vendor-provided update. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2025-24898)

Affected packages:

- `openssl >= 0.0.0-0, < 0.10.70`

Patched in:

- `openssl 0.10.70`

Source: https://osv.dev/vulnerability/RUSTSEC-2025-0004