Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

openssl

12 known vulnerabilities (5 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 5 high, 4 medium, 1 low
Weekly downloads
6.3M
Registry
crates.io

Advisories 12

  • CVE-2026-45784Medium 5.1

    rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

    Affected: from 0.10.50, fixed in 0.10.80.

  • CVE-2026-44662Medium 5.1

    rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding

    Affected: from 0.10.0, fixed in 0.10.79.

  • rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

    Affected: from 0.9.7, fixed in 0.10.79.

  • rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the…

    Affected: from 0.9.24, fixed in 0.10.78.

  • rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check

    Affected: from 0.10.39, fixed in 0.10.78.

  • rust-openssl: Incorrect bounds assertion in aes key wrap

    Affected: from 0.10.24, fixed in 0.10.78.

  • rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length

    Affected: from 0.9.0, fixed in 0.10.78.

  • rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

    Affected: from 0.9.27, fixed in 0.10.78.

  • CVE-2023-53159Medium 4.5

    The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

    Affected: fixed in 0.10.55; from 0.10.0, fixed in 0.10.55.

  • CVE-2025-24898Medium 6.3

    rust openssl ssl::select_next_proto use after free

    Affected: fixed in 0.10.70; from 0.10.0, fixed in 0.10.70.

  • An issue was discovered in the openssl crate before 0.10.9 for Rust.

    Affected: from 0.10.8, fixed in 0.10.9.

  • An issue was discovered in the openssl crate before 0.9.0 for Rust.

    Affected: fixed in 0.9.0; fixed in 0.9.0.