rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

The frompemcallback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this...

chinillaclvmr (>=0.1.24, <=0.2.0), clvmr (>=0.1.22, <=0.2.5) +7 more potentially affected by CVE-2026-41678 via openssl (>=0.10.40, <=0.10.57)

openssl CARGO version =0.10.40, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.1.0-beta.1, =0.1.24, =0.2.5 - rsca 0.2.0 - wagu 0.5.0 - ya-client-model 0.2.0 Source cves: CVE-2026-41678 Source advisory: GHSA-8C75-8MHR-P7R9...

chinillaclvmr (>=0.1.24, <=0.2.0), clvmr (>=0.1.22, <=0.2.5) +7 more potentially affected by CVE-2026-41678 via openssl (>=0.10.40, <=0.10.57)

openssl CARGO version =0.10.40, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.1.0-beta.1, =0.1.24, =0.2.5 - rsca 0.2.0 - wagu 0.5.0 - ya-client-model 0.2.0 Source cves: CVE-2026-41678 Source advisory: OSV:GHSA-8C75-8MHR-P7R9...

GHSA-8C75-8MHR-P7R9 rust-openssl has incorrect bounds assertion in aes key wrap

Summary aes::unwrapkey has an incorrect bounds assertion on the out buffer size, which can lead to out-of-bounds write. Details aes::unwrapkey contains an incorrect assertion: it checks that out.len + 8 = in.len - 8, ensuring the output buffer is large enough. Because of the inverted check, the...

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

EVPDigestFinal always writes EVPMDCTXsizectx to the out buffer. If out is smaller than that, MdCtxRef::digestfinal writes past its end, usually corrupting the stack. This is reachable from safe Rust...

GHSA-GHM9-CR32-G9QJ rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

EVPDigestFinal always writes EVPMDCTXsizectx to the out buffer. If out is smaller than that, MdCtxRef::digestfinal writes past its end, usually corrupting the stack. This is reachable from safe Rust...

chinillaclvmr (>=0.1.24, <=0.2.0), clvmr (>=0.1.22, <=0.2.5) +7 more potentially affected by CVE-2026-41681 via openssl (>=0.10.40, <=0.10.57)

openssl CARGO version =0.10.40, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.1.0-beta.1, =0.1.24, =0.2.5 - rsca 0.2.0 - wagu 0.5.0 - ya-client-model 0.2.0 Source cves: CVE-2026-41681 Source advisory: GHSA-GHM9-CR32-G9QJ...

chinillaclvmr (>=0.1.24, <=0.2.0), clvmr (>=0.1.22, <=0.2.5) +7 more potentially affected by CVE-2026-41681 via openssl (>=0.10.40, <=0.10.57)

openssl CARGO version =0.10.40, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.1.0-beta.1, =0.1.24, =0.2.5 - rsca 0.2.0 - wagu 0.5.0 - ya-client-model 0.2.0 Source cves: CVE-2026-41681 Source advisory: OSV:GHSA-GHM9-CR32-G9QJ...

aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +362 more potentially affected by CVE-2026-41898 via openssl (>=0.9.24, <=0.10.57)

openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.2.0, =0.15.0, =0.3.1, =0.0.1, =0.3.2, =0.1.1, =0.1.4, =0.1.0, =0.1.3, =0.4.0, =0.5.4 and more Source cves: CVE-2026-41898 Source advisory: OSV:GHSA-HPPC-G8H3-XHP3...

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

The FFI trampolines behind SslContextBuilder::setpskclientcallback, setpskservercallback, setcookiegeneratecb, and setstatelesscookiegeneratecb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut u8 that was handed to the closure. This can lead to...

GHSA-HPPC-G8H3-XHP3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

The FFI trampolines behind SslContextBuilder::setpskclientcallback, setpskservercallback, setcookiegeneratecb, and setstatelesscookiegeneratecb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut u8 that was handed to the closure. This can lead to...

aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +362 more potentially affected by CVE-2026-41898 via openssl (>=0.9.24, <=0.10.57)

openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.2.0, =0.15.0, =0.3.1, =0.0.1, =0.3.2, =0.1.1, =0.1.4, =0.1.0, =0.1.3, =0.4.0, =0.5.4 and more Source cves: CVE-2026-41898 Source advisory: GHSA-HPPC-G8H3-XHP3...

Security Bulletin: Muliple security vulnerabilities found in IBM CICS TX Standard.

Summary Multiple security vulnerabilities found in IBM CICS TX Standard. An update to IBM CICS TX Standard has been released to address multiple vulnerabilities in brotli, gnutls, libssh, openssl, curl, binutils, gnupg2, glib2 packages. Vulnerability Details CVEID:CVE-2025-9230 DESCRIPTION: Issue...

Security Bulletin: Muliple security vulnerabilities found in TXSeries for Multiplatforms.

Summary Multiple security vulnerabilities found in TXSeries for Multiplatforms. An update to TXSeries for Multiplatforms has been released to address multiple vulnerabilities in perl, gnupg2, binutils, curl, openssl, glib2 packages. Vulnerability Details CVEID:CVE-2025-68973 DESCRIPTION: In GnuPG...

SUSE-SU-2026:1550-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678...

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like Ya...

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like Ya...

SUSE-SU-2026:1549-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678...

CVE-2026-5501

wolfSSLX509verifycert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints CA:FALSE that is legitimately signed by a trusted root. An attacker who obtains any leaf...

Siemens RUGGEDCOM, SCALANCE and SIMATIC Out-of-bounds Read (CVE-2021-3712)

ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL 0 byte...