CVE-2026-41676

CVE-2026-41676 affects rust-openssl bindings. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive incorrectly pass in/out lengths to EVP_PKEY_derive by using len = buf.len(). On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore this incoming keylen and write the full share...