rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior. This vulnerability is fixed in 0.10.79.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade aws-nitro-enclaves-cliUpgrade aws-nitro-enclaves-cli-develUpgrade aws-nitro-enclaves-cli-debuginfoUpgrade aws-nitro-enclaves-cli-integration-tests | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade clamav1.5Upgrade clamav1.5-freshclam-debuginfoUpgrade clamav1.5-lib-debuginfoUpgrade aws-nitro-enclaves-cli-develUpgrade clamav1.5-libUpgrade clamd1.5Upgrade clamav1.5-develUpgrade aws-nitro-enclaves-cli-integration-testsUpgrade clamav1.5-freshclamUpgrade clamav1.5-milterUpgrade clamav1.5-filesystemUpgrade clamav1.5-docUpgrade clamd1.5-debuginfoUpgrade clamav1.5-milter-debuginfoUpgrade clamav1.5-debuginfoUpgrade clamav1.5-debugsourceUpgrade clamav1.5-dataUpgrade aws-nitro-enclaves-cli | Jun 23, 2026 | May 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub