# openssl (crates.io) vulnerabilities

12 known vulnerabilities (5 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 6.3M
- Registry: https://crates.io/crates/openssl

## Advisories (12)

### [CVE-2026-45784](https://cve.now/CVE-2026-45784): rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers

- Severity: Medium 5.1
- Published: Jul 17, 2026
- Affected: from 0.10.50, fixed in 0.10.80.

### [CVE-2026-44662](https://cve.now/CVE-2026-44662): rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding

- Severity: Medium 5.1
- Published: May 14, 2026
- Affected: from 0.10.0, fixed in 0.10.79.

### [CVE-2026-42327](https://cve.now/CVE-2026-42327): rust-openssl: undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs

- Severity: High 8.7
- Published: May 14, 2026
- Affected: from 0.9.7, fixed in 0.10.79.

### [CVE-2026-41898](https://cve.now/CVE-2026-41898): rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the…

- Severity: High 8.3
- Published: Apr 24, 2026
- Affected: from 0.9.24, fixed in 0.10.78.

### [CVE-2026-41681](https://cve.now/CVE-2026-41681): rust-openssl: MdCtxRef::digest\_final() writes past caller buffer with no length check

- Severity: High 8.1
- Published: Apr 24, 2026
- Affected: from 0.10.39, fixed in 0.10.78.

### [CVE-2026-41678](https://cve.now/CVE-2026-41678): rust-openssl: Incorrect bounds assertion in aes key wrap

- Severity: High 7.2
- Published: Apr 24, 2026
- Affected: from 0.10.24, fixed in 0.10.78.

### [CVE-2026-41677](https://cve.now/CVE-2026-41677): rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length

- Severity: Low 1.7
- Published: Apr 24, 2026
- Affected: from 0.9.0, fixed in 0.10.78.

### [CVE-2026-41676](https://cve.now/CVE-2026-41676): rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

- Severity: High 7.2
- Published: Apr 24, 2026
- Affected: from 0.9.27, fixed in 0.10.78.

### [CVE-2023-53159](https://cve.now/CVE-2023-53159): The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set\_host.

- Severity: Medium 4.5
- Published: Jul 28, 2025
- Affected: fixed in 0.10.55; from 0.10.0, fixed in 0.10.55.

### [CVE-2025-24898](https://cve.now/CVE-2025-24898): rust openssl ssl::select\_next\_proto use after free

- Severity: Medium 6.3
- Published: Feb 3, 2025
- Affected: fixed in 0.10.70; from 0.10.0, fixed in 0.10.70.

### [CVE-2018-20997](https://cve.now/CVE-2018-20997): An issue was discovered in the openssl crate before 0.10.9 for Rust.

- Severity: Unrated
- Published: Aug 26, 2019
- Affected: from 0.10.8, fixed in 0.10.9.

### [CVE-2016-10931](https://cve.now/CVE-2016-10931): An issue was discovered in the openssl crate before 0.9.0 for Rust.

- Severity: Unrated
- Published: Aug 26, 2019
- Affected: fixed in 0.9.0; fixed in 0.9.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io/openssl
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.