PT-2026-35041 · Pypi · Rust-Openssl

Alex · Published 2026-04-22 · Updated 2026-04-30 · CVE-2026-41898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rust-openssl versions 0.9.24 through 0.10.77

Description FFI trampolines behind the functions set psk client callback(), set psk server callback(), set cookie generate cb(), and set stateless cookie generate cb() in SslContextBuilder forward the user closure's returned usize directly to OpenSSL. This occurs without verifying the value against the &mut [u8] provided to the closure, which can result in buffer overflows and other unintended consequences.

Recommendations Update to version 0.10.78.

Fix

Buffer Over-read

Weakness Enumeration

CWE-130

CWE-126

Related Identifiers

CVE-2026-41898

GHSA-HPPC-G8H3-XHP3

Affected Products

Rust-Openssl

References · 15

• https://github.com/rust-openssl/rust-openssl/commit/1d109020d98fff2fb2e45c39a373af3dff99b24c · Patch
• https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-hppc-g8h3-xhp3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41898 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41898 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41898 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41898 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hppc-g8h3-xhp3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41898 · Security Note
• https://github.com/rust-openssl/rust-openssl/pull/2607 · Note
• https://github.com/rust-openssl/rust-openssl · Note
• https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78 · Note
• https://twitter.com/CVEnew/status/2047798597782220812 · Twitter Post
• https://twitter.com/NewsNerdie/status/2048100321017164191 · Twitter Post
• https://t.me/msrcreports/4093 · Telegram Post