CVE-2026-41676

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

• CWE-131
• CWE-787

• https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5Vendor Advisory

Published

Apr 24, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41670Admidio is an open-source user management solution. Prior to…8.2
• CVE-2026-41671Admidio is an open-source user management solution. Prior to…6.8
• CVE-2026-41672xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…7.5
• CVE-2026-41673xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…7.5
• CVE-2026-41674xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…7.5
• CVE-2026-41675xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…7.5
• CVE-2026-41677rust-openssl provides OpenSSL bindings for the Rust programm…9.1
• CVE-2026-41678rust-openssl provides OpenSSL bindings for the Rust programm…8.1
• CVE-2026-41679Paperclip is a Node.js server and React UI that orchestrates…10
• CVE-2026-4168A vulnerability was identified in Tecnick TCExam 16.5.0. Thi…2.4
• CVE-2026-41680Marked is a markdown parser and compiler. From 18.0.0 to 18.…7.5
• CVE-2026-41681rust-openssl provides OpenSSL bindings for the Rust programm…7.5