8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41681

CVE-2026-41681: rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41681

CVE-2026-41681:

8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openssl	rust	>= 0.10.39, < 0.10.78	0.10.78

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the MdCtxRef::digest_final function in openssl/src/md_ctx.rs. The function takes a mutable slice out as an argument to store the digest. The underlying call to OpenSSL's EVP_DigestFinal writes a fixed number of bytes equal to the digest size. The vulnerability occurs because, prior to the patch, there was no check to ensure that the provided out slice was large enough to hold the entire digest. This could lead to a buffer overflow on the stack. The provided commit 826c3888b77add418b394770e2b2e3a72d9f92fe introduces a check if self.size() > len as usize to validate the buffer size before calling EVP_DigestFinal, thus mitigating the vulnerability. The added test case digest_final_checks_length further confirms this by asserting that an error is returned when a buffer of insufficient size is provided.

Vulnerable functions

MdCtxRef::digest_final

openssl/src/md_ctx.rs

The function `digest_final` is vulnerable to a stack-based buffer overflow. Before the patch, the function did not check if the output buffer `out` was large enough to hold the digest. If a smaller buffer was provided, `EVP_DigestFinal()` would write past the end of the buffer, leading to a buffer overflow. The patch adds a size check to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.