{"id":"CVE-2025-24898","summary":"rust openssl ssl::select_next_proto use after free","details":"rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.","aliases":["GHSA-rpmj-rpgj-qmpm","RUSTSEC-2025-0004"],"modified":"2026-08-14T18:51:41.858859472Z","published":"2025-02-03T17:57:39.558Z","related":["ALSA-2025:7147","ALSA-2025:7160","ALSA-2025:7241","ALSA-2025:7313","ALSA-2025:7317","CGA-wgrp-6w47-xfpg","SUSE-SU-2026:23036-1","SUSE-SU-2026:23070-1","openSUSE-SU-2025:14814-1","openSUSE-SU-2026:21464-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24898.json"},"references":[{"type":"WEB","url":"https://crates.io/crates/openssl"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00009.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24898.json"},{"type":"ADVISORY","url":"https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24898"},{"type":"FIX","url":"https://github.com/sfackler/rust-openssl/pull/2360"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rust-openssl/rust-openssl","events":[{"introduced":"d85e2a293778d2a01d715060e7516a8828b0a5ac"},{"fixed":"a4d399b0f1a3694cb2d1728edf74d318a3cac890"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.10.0"},{"fixed":"0.10.70"}]}}],"versions":["openssl-sys-v0.9.105","openssl-v0.10.69","openssl-v0.10.68","openssl-v0.10.67","openssl-sys-v0.9.104","openssl-v0.10.66","openssl-v0.10.65","openssl-sys-v0.9.103","openssl-sys-v0.9.102","openssl-sys-v0.9.101","openssl-v0.10.64","openssl-sys-v0.9.100","openssl-v0.10.63","openssl-sys-v0.9.99","openssl-v0.10.62","openssl-sys-v0.9.98","openssl-v0.10.61","openssl-sys-v0.9.97","openssl-v0.10.60","openssl-sys-v0.9.96","openssl-v0.10.59","openssl-sys-v0.9.95","openssl-v0.10.58","openssl-sys-v0.9.94","openssl-sys-v0.9.93","openssl-v0.10.57","openssl-sys-v0.9.92","openssl-v0.10.56","openssl-sys-v0.9.91","openssl-sys-v0.9.90","openssl-v0.10.55","openssl-sys-v0.9.89","openssl-v0.10.54","openssl-v0.10.53","openssl-sys-v0.9.88","openssl-v0.10.52","openssl-sys-v0.9.87","openssl-v0.10.51","openssl-sys-v0.9.86","openssl-v0.10.50","openssl-sys-v0.9.85","openssl-v0.10.49","openssl-sys-v0.9.84","openssl-macros-v0.1.1","openssl-v0.10.48","openssl-sys-v0.9.83","openssl-v0.10.47","openssl-sys-v0.9.82","openssl-v0.10.46","openssl-sys-v0.9.81","openssl-v0.10.45","openssl-sys-v0.9.80","openssl-v0.10.44","openssl-sys-v0.9.79","openssl-v0.10.43","openssl-sys-v0.9.78","openssl-sys-v0.9.77","openssl-v0.10.42","openssl-sys-v0.9.76","openssl-v0.10.41","openssl-sys-v0.9.75","openssl-sys-v0.9.74","openssl-v0.10.40","openssl-v0.10.39","openssl-macros-v0.1.0","openssl-sys-v0.9.73","openssl-sys-v0.9.72","openssl-sys-v0.9.71","openssl-sys-v0.9.65","openssl-sys-v0.9.70","openssl-v0.10.38","openssl-sys-v0.9.69","openssl-v0.10.37","openssl-sys-v0.9.68","openssl-sys-v0.9.67","openssl-v0.10.36","openssl-sys-v0.9.66","openssl-errors-v0.2.0","openssl-v0.10.35","openssl-sys-v0.9.64","openssl-sys-v0.9.63","openssl-v0.10.34","openssl-sys-v0.9.62","openssl-v0.10.33","openssl-sys-v0.9.61","openssl-v0.10.32","openssl-sys-v0.9.60","openssl-v0.10.31","openssl-sys-v0.9.59","openssl-v0.10.30","openssl-sys-v0.9.58","openssl-sys-v0.9.57","openssl-sys-v0.9.56","openssl-v0.10.29","openssl-sys-v0.9.55","openssl-v0.10.28","openssl-v0.9.27","openssl-v0.10.27","openssl-sys-v0.9.54","openssl-v0.10.26","openssl-sys-v0.9.53","openssl-sys-v0.9.52","openssl-sys-v0.9.51","openssl-v0.10.25","openssl-sys-v0.9.50","openssl-sys-v0.9.49","openssl-v0.10.24","openssl-sys-v0.9.48","openssl-v0.10.23","openssl-sys-v0.9.47","openssl-v0.10.22","openssl-sys-v0.9.46","openssl-sys-v0.9.45","openssl-v0.10.21","openssl-sys-v0.9.44","openssl-v0.10.20","openssl-sys-v0.9.43","openssl-errors-v0.1.0","openssl-v0.10.19","openssl-sys-v0.9.42","openssl-v0.10.18","openssl-v0.10.17","openssl-sys-v0.9.41","openssl-v0.10.16","openssl-sys-v0.9.40","openssl-v0.10.15","openssl-v0.10.14","openssl-sys-v0.9.39","openssl-sys-v0.9.38","openssl-v0.10.13","openssl-sys-v0.9.37","openssl-v0.10.12","openssl-sys-v0.9.36","openssl-v0.10.11","openssl-sys-v0.9.35","openssl-v0.10.10","openssl-sys-v0.9.33","openssl-v0.10.9","openssl-sys-v0.9.32","openssl-v0.10.8","openssl-sys-v0.9.31","openssl-v0.10.7","openssl-sys-v0.9.30","openssl-v0.10.6","openssl-sys-v0.9.28","openssl-v0.10.5","openssl-sys-v0.9.27","openssl-v0.10.4","openssl-sys-v0.9.26","openssl-v0.10.3","openssl-sys-v0.9.25","openssl-v0.10.2","openssl-v0.10.1","openssl-v0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24898.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"}]}