Use After Free Vulnerability in rust-openssl Affecting OpenSSL Bindings

CVE-2025-24898

What is CVE-2025-24898?

The rust-openssl library, which provides OpenSSL bindings for the Rust programming language, contains a vulnerability in the ssl::select_next_proto function. This function can mistakenly return a memory slice that is bound to the lifetime of the client argument while actually pointing into the buffer of the server argument. In scenarios where the server buffer's lifetime is less than that of the client buffer, it may lead to a use after free condition. This vulnerability can potentially cause crashes of the server or expose arbitrary memory contents to clients. It is critical for users to update to version 0.10.70 of the openssl crate to mitigate this issue, especially in standard use cases involving callbacks via SslContextBuilder::set_alpn_select_callback.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References