CVE-2026-41898

Name of the Vulnerable Software and Affected Versions rust-openssl versions 0.9.24 through 0.10.77

Description FFI trampolines behind the functions set psk client callback(), set psk server callback(), set cookie generate cb(), and set stateless cookie generate cb() in SslContextBuilder forward the user closure's returned usize directly to OpenSSL. This occurs without verifying the value against the &mut [u8] provided to the closure, which can result in buffer overflows and other unintended consequences.

Recommendations Update to version 0.10.78.