Is CVE-2026-42327 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42327 being exploited in the wild.

How severe is CVE-2026-42327?

High severity, with a CVSS score of 4, published 14 May 2026.

Which products and versions are affected?

openssl (crates.io) SEMVER:introduced=0.9.7,fixed=0.10.79.

Is there a fix for CVE-2026-42327?

Yes. openssl (crates.io): upgrade to 0.10.79 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42327 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42327?

Check whether you run openssl (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42327: rust-openssl undefined behavior in X509Ref::ocsp_responders

CVE-2026-42327 · Severity: high · CVSS 4 · Published 2026-05-14

A security vulnerability exists in the Rust bindings for OpenSSL, a library used by many applications to handle secure communications and digital certificates. When processing a specially crafted digital certificate containing invalid data in its web address fields, the library may experience 'undefined behavior,' which can lead to unpredictable system crashes or memory corruption. This could allow an attacker to compromise the integrity of applications that validate or process these certificates.

Technologies: openssl (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-42327 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42327 being exploited in the wild.
How severe is CVE-2026-42327?: High severity, with a CVSS score of 4, published 14 May 2026.
Which products and versions are affected?: openssl (crates.io) SEMVER:introduced=0.9.7,fixed=0.10.79.
Is there a fix for CVE-2026-42327?: Yes. openssl (crates.io): upgrade to 0.10.79 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42327 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42327?: Check whether you run openssl (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl (crates.io): upgrade to 0.10.79 or later
```
cargo update -p openssl
```

Technical details

The vulnerability exists in the `X509Ref::ocsp_responders` function within the `rust-openssl` crate. The function retrieves OCSP responder URLs from a certificate's Authority Information Access (AIA) extension and returns them as an `OpensslString`. This type implements `Deref<Target = str>` by calling `str::from_utf8_unchecked` on the raw bytes provided by OpenSSL. Because OpenSSL does not strictly enforce that IA5String fields contain only ASCII/UTF-8 data, a certificate containing non-UTF-8 bytes in the `accessLocation` field will cause safe Rust code to create an invalid `&str` reference. This violation of Rust's UTF-8 invariant results in undefined behavior, which can be triggered by any network-reachable service that parses untrusted X.509 certificates. The issue is fixed in version 0.10.79.

Affected products

rust-openssl openssl (rust-openssl) >= 0.9.7, < 0.10.79

Identifiers

CVE-2026-42327
GHSA-xp3w-r5p5-63rr
RUSTSEC-2026-0474

Timeline

2026-05-04: disclosed
2026-05-05: advisory
2026-05-14: patched: NVD publication and patch confirmation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.