PT-2026-34623 · Pypi · Rust-Openssl

Alex · Published 2026-04-22 · Updated 2026-04-30 · CVE-2026-41681

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rust-openssl versions 0.10.39 through 0.10.77

Description The EVP DigestFinal() function always writes EVP MD CTX size(ctx) to the out buffer. If the out buffer is smaller than that size, the MdCtxRef::digest final() function writes past its end, which typically results in stack corruption. This issue is reachable from safe Rust.

Recommendations Update to version 0.10.78.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-41681

GHSA-GHM9-CR32-G9QJ

Affected Products

Rust-Openssl

References · 16

• https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe · Patch
• https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-ghm9-cr32-g9qj · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ghm9-cr32-g9qj · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41681 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41681 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41681 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41681 · Vendor Advisory
• https://github.com/rust-openssl/rust-openssl · Note
• https://github.com/rust-openssl/rust-openssl/pull/2608 · Note
• https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78 · Note
• https://t.me/msrcreports/4095 · Telegram Post
• https://twitter.com/CVEnew/status/2047798598763725049 · Twitter Post
• https://twitter.com/dailycve/status/2047442376382202012 · Twitter Post