CVE-2026-42327

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior. This vulnerability is fixed in 0.10.79.

• CWE-20

• https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xp3w-r5p5-63rr

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42317GLPI is a free asset and IT management software package. Sta…7
• CVE-2026-42318GLPI is a free asset and IT management software package. Sta…7
• CVE-2026-4232A vulnerability was determined in Tiandy Integrated Manageme…7.3
• CVE-2026-42320GLPI is a free asset and IT management software package. Sta…5.9
• CVE-2026-42321GLPI is a free asset and IT management software package. Sta…8.4
• CVE-2026-42326ImageMagick is free and open-source software used for editin…5.1
• CVE-2026-42328go-ipld-prime is an implementation of the InterPlanetary Lin…6.2
• CVE-2026-42329Iris is a web collaborative platform that helps incident res…4.7
• CVE-2026-4233A vulnerability was identified in ThingsGateway 12. This aff…4.3
• CVE-2026-42331FOSSBilling is a free, open-source billing and client manage…7.7
• CVE-2026-42333Quarkus OpenAPI Generator is Quarkus' extensions for generat…6.3
• CVE-2026-42334Mongoose is a MongoDB object modeling tool designed to work …7.5