CVE-2026-41676High· 7.5▾ Twilightrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on Ope…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.
rust-openssl >= 0.9.27, < 0.10.78Upgrade past the affected range:
rust-openssl 0.10.78Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41678High· 8.1rust-openssl provides OpenSSL bindings for the Rust programming language
CVE-2025-62550High· 8.8Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
CVE-2026-41898Medium· 5.3rust-openssl provides OpenSSL bindings for the Rust programming language
CVE-2026-41681High· 7.5rust-openssl provides OpenSSL bindings for the Rust programming language
CVE-2026-57192Medium· 6.0Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
CVE-2026-112709Critical· 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution