rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior. This vulnerability is fixed in 0.10.79.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade aws-nitro-enclaves-cliUpgrade aws-nitro-enclaves-cli-develUpgrade aws-nitro-enclaves-cli-debuginfoUpgrade aws-nitro-enclaves-cli-integration-tests | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade clamav1.5-dataUpgrade clamav1.5-debugsourceUpgrade aws-nitro-enclaves-cli-integration-testsUpgrade clamav1.5-freshclamUpgrade clamd1.5-debuginfoUpgrade clamav1.5-milterUpgrade clamav1.5-develUpgrade clamav1.5-milter-debuginfoUpgrade aws-nitro-enclaves-cliUpgrade clamav1.5-debuginfoUpgrade clamav1.5-filesystemUpgrade clamav1.5-docUpgrade clamav1.5-lib-debuginfoUpgrade clamav1.5Upgrade clamd1.5Upgrade clamav1.5-freshclam-debuginfoUpgrade clamav1.5-libUpgrade aws-nitro-enclaves-cli-devel | Jun 23, 2026 | May 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub