Rust-openssl_project Rust-openssl
7 CVEs affecting Rust-openssl_project Rust-openssl. Latest disclosed: 2026-04-24. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-20997 | Critical | 9.8 | 2019-08-26 | An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing. |
CVE-2026-41677 | Critical | 9.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the leng… |
CVE-2026-41678 | High | 8.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it check… |
CVE-2016-10931 | High | 8.1 | 2019-08-26 | An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off… |
CVE-2026-41681 | High | 7.5 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx)… |
CVE-2026-41676 | High | 7.5 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = b… |
CVE-2026-41898 | Medium | 5.3 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk… |