# CVE-2026-42327: rust-openssl undefined behavior in X509Ref::ocsp_responders

Source: https://junglewise.ai/threats/cve-2026-42327-rust-openssl-undefined-behavior-in-x509ref-ocsp-responders  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-42327 · Severity: high · CVSS 4 · Published 2026-05-14

A security vulnerability exists in the Rust bindings for OpenSSL, a library used by many applications to handle secure communications and digital certificates. When processing a specially crafted digital certificate containing invalid data in its web address fields, the library may experience 'undefined behavior,' which can lead to unpredictable system crashes or memory corruption. This could allow an attacker to compromise the integrity of applications that validate or process these certificates.

Technologies: [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-42327 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42327 being exploited in the wild.

**How severe is CVE-2026-42327?** High severity, with a CVSS score of 4, published 14 May 2026.

**Which products and versions are affected?** openssl (crates.io) SEMVER:introduced=0.9.7,fixed=0.10.79.

**Is there a fix for CVE-2026-42327?** Yes. openssl (crates.io): upgrade to 0.10.79 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42327 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42327?** Check whether you run openssl (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openssl (crates.io): upgrade to 0.10.79 or later

  ```sh
  cargo update -p openssl
  ```


## Technical details

The vulnerability exists in the `X509Ref::ocsp_responders` function within the `rust-openssl` crate. The function retrieves OCSP responder URLs from a certificate's Authority Information Access (AIA) extension and returns them as an `OpensslString`. This type implements `Deref<Target = str>` by calling `str::from_utf8_unchecked` on the raw bytes provided by OpenSSL. Because OpenSSL does not strictly enforce that IA5String fields contain only ASCII/UTF-8 data, a certificate containing non-UTF-8 bytes in the `accessLocation` field will cause safe Rust code to create an invalid `&str` reference. This violation of Rust's UTF-8 invariant results in undefined behavior, which can be triggered by any network-reachable service that parses untrusted X.509 certificates. The issue is fixed in version 0.10.79.

## Affected products

- rust-openssl openssl (rust-openssl) >= 0.9.7, < 0.10.79

## Identifiers

- CVE-2026-42327
- GHSA-xp3w-r5p5-63rr
- RUSTSEC-2026-0474

## Timeline

- 2026-05-04: disclosed
- 2026-05-05: advisory
- 2026-05-14: patched: NVD publication and patch confirmation

## References

- [https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xp3w-r5p5-63rr](https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xp3w-r5p5-63rr)
- [https://api.github.com/repos/rust-openssl/rust-openssl/security-advisories/GHSA-xp3w-r5p5-63rr](https://api.github.com/repos/rust-openssl/rust-openssl/security-advisories/GHSA-xp3w-r5p5-63rr)

## Related threats

- [rust-openssl heap overflow in CipherCtxRef::cipher_update_inplace](https://junglewise.ai/threats/cve-2026-45784-rust-openssl-heap-overflow-in-cipherctxref-cipher-update-inplace)
- [rust-openssl heap buffer overflow in AES key-wrap-with-padding](https://junglewise.ai/threats/cve-2026-44662-rust-openssl-heap-buffer-overflow-in-aes-key-wrap-with-padding)
- [rust-openssl buffer over-read in PSK and cookie callbacks](https://junglewise.ai/threats/cve-2026-41898-rust-openssl-buffer-over-read-in-psk-and-cookie-callbacks)
- [rust-openssl stack buffer overflow in MdCtxRef::digest_final](https://junglewise.ai/threats/cve-2026-41681-rust-openssl-stack-buffer-overflow-in-mdctxref-digest-final)
- [rust-openssl out-of-bounds write in aes::unwrap_key](https://junglewise.ai/threats/cve-2026-41678-rust-openssl-out-of-bounds-write-in-aes-unwrap-key)