Vulnerability Details CVE-2026-41898
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 32.7%
CVSS Severity
CVSS v3 Score 9.8
Products affected by CVE-2026-41898
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.0
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.1
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.10
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.11
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.12
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.13
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.14
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.15
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.16
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.17
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.18
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.19
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.2
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.20
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.21
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.22
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.23
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.24
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.25
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.26
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.27
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.28
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.29
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.3
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.30
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.31
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.32
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.33
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.34
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.35
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.36
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.37
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.38
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.39
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.4
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.40
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.41
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.42
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.43
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.44
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.45
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.46
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.47
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.48
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.49
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.5
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.50
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.51
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.52
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.53
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.54
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.55
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.56
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.57
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.58
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.59
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.6
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.60
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.61
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.62
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.63
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.64
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.65
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.66
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.67
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.68
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.69
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.7
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.70
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.71
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.72
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.73
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.74
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.75
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.76
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.77
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.8
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.10.9
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.100
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.101
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.102
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.103
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.104
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.105
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.106
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.107
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.108
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.109
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.110
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.111
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.112
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.113
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.114
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.24
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.25
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.26
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.27
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.28
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.30
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.31
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.32
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.33
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.35
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.36
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.37
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.38
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.39
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.40
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.41
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.42
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.43
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.44
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.45
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.46
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.47
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.48
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.49
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.50
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.51
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.52
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.53
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.54
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.55
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.56
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.57
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.58
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.59
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.60
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.61
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.62
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.63
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.64
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.65
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.66
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.67
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.68
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.69
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.70
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.71
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.72
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.73
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.74
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.75
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.76
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.77
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.78
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.79
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.80
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.81
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.82
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.83
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.84
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.85
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.86
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.87
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.88
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.89
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.90
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.91
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.92
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.93
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.94
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.95
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.96
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.97
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.98
-
cpe:2.3:a:rust-openssl_project:rust-openssl:0.9.99