{"id":"RUSTSEC-2026-0477","summary":"Buffer overflow with AES key wrap with padding in `cipher_update_inplace`","details":"`CipherCtxRef::cipher_update_inplace` had the same sizing error that 0.10.79 fixed in `cipher_update` (GHSA-xv59-967r-8726); that fix missed this method. It required room for `inlen + block_size` bytes, but with the AES key-wrap-with-padding ciphers OpenSSL writes up to 7 more bytes when `inlen` is not a multiple of 8, past the end of `data`.\n\nOnly users of the AES key-wrap-with-padding ciphers are affected. `cipher_update_inplace` was added in 0.10.50, and 0.10.80 applies the corrected size check to it.","aliases":["CVE-2026-45784","GHSA-phqj-4mhp-q6mq"],"modified":"2026-11-10T14:00:02.477702931Z","published":"2026-05-16T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/openssl"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0477.html"},{"type":"WEB","url":"https://github.com/rust-openssl/rust-openssl/pull/2638"}],"affected":[{"package":{"name":"openssl","ecosystem":"crates.io","purl":"pkg:cargo/openssl"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.50"},{"fixed":"0.10.80"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":["openssl::cipher_ctx::CipherCtxRef::cipher_update_inplace"],"arch":[]}},"database_specific":{"cvss":null,"informational":null,"categories":["memory-corruption"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0477.json"}}],"schema_version":"1.9.2"}