RUSTSEC-2026-0477

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0477

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0477.json

JSON Data

https://api.test.osv.dev/v1/vulns/RUSTSEC-2026-0477

Aliases

Published

2026-05-16T12:00:00Z

Modified

2026-11-10T14:00:04Z

Summary

Buffer overflow with AES key wrap with padding in `cipher_update_inplace`

Details

CipherCtxRef::cipher_update_inplace had the same sizing error that 0.10.79 fixed in cipher_update (GHSA-xv59-967r-8726); that fix missed this method. It required room for inlen + block_size bytes, but with the AES key-wrap-with-padding ciphers OpenSSL writes up to 7 more bytes when inlen is not a multiple of 8, past the end of data.

Only users of the AES key-wrap-with-padding ciphers are affected. cipher_update_inplace was added in 0.10.50, and 0.10.80 applies the corrected size check to it.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / openssl

Package

Name: openssl; View open source insights on deps.dev
Purl: pkg:cargo/openssl

Affected ranges

Type: SEMVER
Events: Introduced

0.10.50

Fixed

0.10.80

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "openssl::cipher_ctx::CipherCtxRef::cipher_update_inplace"
        ],
        "os": []
    }
}