RUSTSEC-2026-0463

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0463

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0463.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0463

Aliases

Published

2026-04-19T12:00:00Z

Modified

2026-11-09T16:15:02Z

Summary

Out-of-bounds write in `aes::unwrap_key`

Details

openssl::aes::unwrap_key guarded the size of its output buffer with an inverted assertion, out.len() + 8 <= in_.len(). Instead of rejecting an out buffer too small for the unwrapped key, it rejected buffers larger than needed and accepted buffers that were too small.

When out is shorter than in_.len() - 8 bytes, the underlying AES_unwrap_key call writes past the end of out. This out-of-bounds write is reachable from a safe function; applications that let untrusted input influence the input or output buffer sizes are exposed.

The function was added in 0.10.24. 0.10.78 corrects the assertion, so an output buffer that is too small now causes a panic before anything is written.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / openssl

Package

Name: openssl; View open source insights on deps.dev
Purl: pkg:cargo/openssl

Affected ranges

Type: SEMVER
Events: Introduced

0.10.24

Fixed

0.10.78

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "openssl::aes::unwrap_key"
        ],
        "os": []
    }
}