{"id":"RUSTSEC-2026-0479","summary":"Out-of-bounds read when a PEM password callback returns an oversized length","details":"The `*_from_pem_callback` functions, such as `EcKey::private_key_from_pem_callback`, pass the length returned by the user's password callback to OpenSSL without checking it against the size of the buffer the callback was given. If the callback reports more bytes than the buffer holds, some OpenSSL versions read past the end of the buffer while deriving the decryption key. OpenSSL 3.x is not affected.\n\n0.10.78 treats a returned length larger than the buffer as a failed callback.","aliases":["CVE-2026-41677","GHSA-xmgf-hq76-4vx2"],"modified":"2026-11-10T14:00:02.495213447Z","published":"2026-04-19T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/openssl"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0479.html"},{"type":"WEB","url":"https://github.com/rust-openssl/rust-openssl/pull/2605"}],"affected":[{"package":{"name":"openssl","ecosystem":"crates.io","purl":"pkg:cargo/openssl"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.10.78"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"categories":["memory-exposure"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0479.json"}}],"schema_version":"1.9.2"}