OpenSSL Bindings Vulnerability in Rust Programming Language by rust-openssl
CVE-2026-42327

8.7HIGH

Key Information:

Vendor

Rust-OpenSSL

Status
Rust-OpenSSL
Vendor
CVE Published:
14 May 2026

What is CVE-2026-42327?

The rust-openssl library, which provides OpenSSL bindings for the Rust programming language, is affected by a vulnerability in its handling of OCSP responder URLs. The impacted versions from 0.9.7 to before 0.10.79 improperly process the URLs returned by the certificate's AIA extension. Due to the use of str::from_utf8_unchecked, it does not verify that the underlying IA5String is ASCII, leading to potential undefined behavior when a certificate contains non-UTF-8 bytes. This issue is resolved in version 0.10.79.

Affected Version(s)

rust-openssl >= 0.9.7, < 0.10.79

References

https://github.com/rust-openssl/rust-openssl/security/adv...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.