CVE-2026-41898

What it actually does

Affected versions of the Rust openssl crate, from 0.9.24 through 0.10.77, expose unsafe FFI callback trampolines for TLS/DTLS PSK and cookie generation APIs. The vulnerable callbacks forward a Rust closure's returned usize length directly to OpenSSL without validating that the length is no larger than the mutable byte slice supplied to the closure. If an application uses SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, or set_stateless_cookie_generate_cb and the callback returns an oversized length, OpenSSL may operate on memory beyond the intended buffer. Depending on how the application implements the callback and how the surrounding TLS/DTLS code handles the returned length, this can cause memory corruption, out-of-bounds reads/writes, crashes, or other unintended behavior. The flaw is in the Rust binding layer, not in OpenSSL itself, and exposure depends on whether downstream applications use the affected APIs.

Why it matters to the business

Applications built with vulnerable rust-openssl versions may be exposed to remotely reachable memory-safety failures in TLS or DTLS handling if they use the affected PSK or cookie callback features. The most likely operational impact is service instability or denial of service, but memory corruption in network-facing cryptographic code is high-risk because it can potentially undermine confidentiality or lead to deeper compromise depending on the application design. Although the EPSS score is currently low at 0.0028 and unchanged over 30 days, and the vulnerability is not listed in CISA KEV or known ransomware use, the CVSS severity is critical and remediation should be prioritized for any internet-facing or security-sensitive Rust services using rust-openssl.

How an attack unfolds

An attacker targets a Rust application that is compiled against an affected openssl crate version and exposes TLS or DTLS functionality using one of the vulnerable callback APIs. The attacker initiates a protocol flow that causes the application to invoke a PSK client/server callback or a DTLS cookie/stateless cookie generation callback. If the callback implementation can be made to return a length larger than the provided output buffer—whether through attacker-influenced identity data, cookie material, configuration, or flawed application logic—the rust-openssl FFI trampoline passes that unchecked length to OpenSSL. OpenSSL then trusts the returned length and may read or write beyond the intended buffer boundary. Successful exploitation may produce a crash, memory corruption, or potentially exposure or manipulation of adjacent memory, depending on the specific callback, platform, compiler settings, allocator behavior, and application code.

How to fix it

Upgrade the Rust openssl crate to version 0.10.78 or later. Regenerate dependency lockfiles and rebuild all affected binaries, containers, and packages so the fixed crate is actually linked into deployed artifacts. Because this is a library issue, updating source manifests alone is insufficient unless downstream applications are recompiled and redeployed. Use cargo update -p openssl --precise 0.10.78 where appropriate, or allow dependency resolution to select a newer fixed version. If immediate upgrade is not possible, reduce exposure by disabling or avoiding use of SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb, and audit callback implementations to ensure they never return a value greater than the length of the provided output buffer. Where practical, place affected services behind network controls, rate limiting, and crash restart supervision until patched.

How to confirm the fix worked

Confirm that no deployed Rust artifact uses openssl crate versions 0.9.24 through 0.10.77. Review Cargo.lock, cargo tree, SBOMs, container image manifests, and build outputs for the openssl crate version and verify it is 0.10.78 or later. Run cargo tree -i openssl to identify which packages introduce the dependency. Search application source for calls to SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb to determine whether the vulnerable callback paths are used. After upgrading, rebuild from a clean dependency cache where possible, redeploy, and verify runtime artifacts were refreshed by checking package metadata, SBOMs, image digests, and service versions. Functional testing should include TLS/DTLS handshake paths that exercise PSK or cookie callbacks, with assertions that callback return lengths are bounded by the supplied buffer length.

Typical attack path

1. Identify a network-accessible Rust service or product using the openssl crate in the affected version range 0.9.24 through 0.10.77.
2. Determine whether the service uses PSK TLS callbacks or DTLS cookie/stateless cookie generation callbacks exposed through SslContextBuilder.
3. Initiate TLS or DTLS handshakes that reach the vulnerable callback path.
4. Send crafted handshake inputs, identities, or parameters that influence the callback output length or generated data size, where the application permits that influence.
5. Trigger the callback to return a usize larger than the provided mutable buffer length.
6. Cause OpenSSL to trust the unchecked length, resulting in out-of-bounds memory access, memory corruption, or process termination.
7. Repeat or refine inputs to achieve reliable denial of service or, in favorable conditions, attempt further exploitation of corrupted process memory.

How to detect it

There are no public, CVE-specific exploitation indicators, no CISA KEV listing, no known ransomware association, and no named threat actors reported for this issue. Detection should focus on identifying vulnerable deployments and looking for symptoms consistent with attempted memory corruption in TLS/DTLS callback paths. Review dependency inventories, SBOMs, Cargo.lock files, CI build logs, and container image contents for openssl crate versions 0.9.24 through 0.10.77. For possible prior exploitation, examine application logs, system journals, container runtime logs, core dump directories, crash reporters, and EDR telemetry for crashes occurring during TLS or DTLS handshakes, especially around PSK authentication or DTLS cookie generation. Useful artifacts include segmentation faults, SIGABRT/SIGSEGV events, allocator corruption messages, repeated process restarts, abnormal handshake failure spikes, and core dumps from Rust services linked against affected rust-openssl versions. Network logs may show repeated malformed or high-volume TLS/DTLS handshake attempts from the same source shortly before crashes, but packet-level indicators will be application-specific.

What your security team should do

• Inventory Rust applications, services, containers, and vendor products that include the openssl crate, prioritizing internet-facing TLS/DTLS services.
• Patch or rebuild affected applications to use openssl crate 0.10.78 or later, prioritizing systems that use PSK TLS or DTLS cookie/stateless cookie callbacks.
• Search source code for the four affected callback APIs and require code review for any callback that returns a generated length.
• Use SCA, SBOM, and CI dependency policies to fail builds that resolve openssl crate versions from 0.9.24 through 0.10.77.
• Monitor affected services for unexplained TLS/DTLS handshake crashes, segmentation faults, aborts, allocator errors, or abnormal restart loops.
• If patching is delayed, restrict network access to affected services, disable exposed PSK/DTLS functionality where feasible, and apply rate limits to handshake traffic.
• Ask vendors of Rust-based appliances, agents, and network services whether their products include rust-openssl in the affected range and whether they use the vulnerable APIs.