rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.
References
| Link | Resource |
|---|---|
| https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7 | Patch |
| https://github.com/rust-openssl/rust-openssl/pull/2638 | Issue Tracking Patch |
| https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.80 | Product Release Notes |
| https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq | Vendor Advisory |
Configurations
History
29 Jul 2026, 15:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sfackler:openssl:*:*:*:*:*:rust:*:* | |
| First Time |
Sfackler openssl
Sfackler |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| References | () https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7 - Patch | |
| References | () https://github.com/rust-openssl/rust-openssl/pull/2638 - Issue Tracking, Patch | |
| References | () https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.80 - Product, Release Notes | |
| References | () https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq - Vendor Advisory |
17 Jul 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-17 21:17
Updated : 2026-07-29 15:43
NVD link : CVE-2026-45784
Mitre link : CVE-2026-45784
CVE.ORG link : CVE-2026-45784
JSON object : View
Products Affected
sfackler
- openssl