7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41676

CVE-2026-41676: rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41676

CVE-2026-41676:

7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openssl	rust	>= 0.9.27, < 0.10.78	0.10.78

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a buffer overflow in the rust-openssl crate, affecting applications using OpenSSL 1.1.1. The core issue lies in the Deriver::derive and PkeyCtxRef::derive functions. These functions are Rust wrappers around the native OpenSSL function EVP_PKEY_derive. The vulnerability arises because the Rust code incorrectly assumed that the EVP_PKEY_derive function would always respect the size of the output buffer provided. However, in OpenSSL 1.1.x, for certain key derivation algorithms like X25519 and X448, the function ignores the provided buffer length and writes the entire derived key. If the caller provides a buffer that is smaller than the full key, a heap or stack-based buffer overflow occurs. This can lead to a crash or potentially arbitrary code execution.

The patch mitigates this by introducing a size check. Before calling the native function, the patched code determines the required buffer size. If the caller's buffer is too small, a temporary buffer of the correct size is allocated. The key derivation is performed into this safe temporary buffer, and then the result is copied (and truncated) back to the original buffer. This fix is specifically enabled for OpenSSL versions where the buggy behavior is present (1.1.x) and is not needed for OpenSSL 3.x, which handles this correctly.

Vulnerable functions

Deriver::derive

openssl/src/derive.rs

The `derive` function in the `Deriver` struct is vulnerable to a buffer overflow. It directly calls the underlying OpenSSL function `EVP_PKEY_derive` with a user-provided buffer. On OpenSSL 1.1.x, for certain key types, this function ignores the provided buffer length and writes the full derived key, which can exceed the buffer's size, leading to an out-of-bounds write.

PkeyCtxRef::derive

openssl/src/pkey_ctx.rs

Similar to `Deriver::derive`, the `derive` function in `PkeyCtxRef` is vulnerable. It wraps the `EVP_PKEY_derive` OpenSSL function and, prior to the patch, did not validate the buffer size against the expected output size. This allows a buffer overflow to occur when a small buffer is provided and the underlying OpenSSL 1.1.x library writes more bytes than the buffer can hold.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.